Receiver.spec.secretRef

SecretRef specifies the Secret containing the token used to validate the payload authenticity. The Secret must contain a 'token' key. For GCR receivers, the Secret must also contain an 'email' key with the IAM service account email configured on the Pub/Sub push subscription, and an 'audience' key with the expected OIDC token audience. Required for all receiver types except 'generic-oidc', which authenticates requests using the OIDC token instead and must not set this field.