[leggetter]

Auth fields placed at the top level of --config / --source-config were silently dropped by the API, so this exited 0 and created a source with no signature verification:

hookdeck gateway connection upsert vapi-acme-dental \
  --source-name vapi-acme-dental --source-type VAPI \
  --source-config '{"webhook_secret_key":"<secret>","algorithm":"sha256","encoding":"hex","header_key":"x-signature"}' \
  --destination-id <destination_id>

The CLI forwards config JSON unchanged except four legacy keys (webhook_secret, api_key, basic_auth, hmac), and the API validates with stripUnknown: true, so nothing reported the problem.

Changes

• Misplaced auth keys fail. validateSourceConfigAuthShape rejects webhook_secret_key, algorithm, encoding, header_key, trim_payload, api_key, username and password at the top level of source config, names them, and prints the corrected JSON with secrets as <placeholder>. Applies to source create/upsert/update (--config, --config-file) and connection create/upsert (--source-config, --source-config-file).
• The shorthand stops guessing. --webhook-secret, --source-webhook-secret and the legacy webhook_secret key send only webhook_secret_key for provider types (e.g. VAPI, STRIPE), so the API applies the type's own defaults (VAPI: x-signature). WEBHOOK, HTTP and an empty type keep x-webhook-signature/sha256/hex, since they have no server-side defaults.
• Tests in pkg/cmd/source_common_test.go. go build ./..., go test ./... and gofmt pass.

Unfinished (for whoever takes this to completion)

• No check after create that auth is configured: responses redact auth, so this needs one test against a real API to see what can be detected.
• Hard error vs warning: a hard error could break scripts that pass flat keys today (those scripts already create unverified sources).
• Fixed key list: provider-specific auth fields not in the list still pass through; real validation depends on pkg/cmd/sources is dead code: source auth validation never runs #341.
• No CHANGELOG or REFERENCE.md entry; no acceptance test.

Related: #341 (CLI-side auth validation is inert), #412 (source update config rejected), #466 (success reported while a change is ignored). The API side is in hookdeck/core.

🤖 Generated with Claude Code

Posted by an AI agent with human oversight.