Use {hidden: true} in place of "<hidden>" as auth key placeholder.
Improve error message for setting the auth key to {hidden: true}