A reference to a consumer-held secret — never the secret itself.

Input casting rejects empty references and values beginning with whsec_, whsk_, or whpk_, the Standard Webhooks key encodings. The same check applies to package actions and consumer actions that accept this type.

Other nonempty binaries are references. The type cannot recognize arbitrary unprefixed secret material; applications must store only identifiers that their secret resolver can look up.