s/authPayload/authSecret/ and use BODY not cmd params