This feels like it should be:

webhook:
  user:
  password:
?