diff --git a/driver/config/provider.go b/driver/config/provider.go
index abacc3e4394..ba1869498fe 100644
--- a/driver/config/provider.go
+++ b/driver/config/provider.go
@@ -5,7 +5,6 @@ package config
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -482,8 +481,13 @@ func (p *DefaultProvider) AccessTokenStrategy(ctx context.Context, additionalSou
 
 type (
 	Auth struct {
-		Type   string          `json:"type"`
-		Config json.RawMessage `json:"config"`
+		Type   string     `json:"type"`
+		Config AuthConfig `json:"config"`
+	}
+	AuthConfig struct {
+		In    string `json:"in"`
+		Name  string `json:"name"`
+		Value string `json:"value"`
 	}
 	HookConfig struct {
 		URL  string `json:"url"`
diff --git a/driver/config/provider_test.go b/driver/config/provider_test.go
index 1b175aa919b..8e5c44a9e2e 100644
--- a/driver/config/provider_test.go
+++ b/driver/config/provider_test.go
@@ -443,18 +443,25 @@ func TestHookConfigs(t *testing.T) {
 		require.NotNil(t, hc)
 		assert.EqualValues(t, "http://localhost:8080/hook", hc.URL)
 
-		c.MustSet(ctx, key, map[string]any{
-			"url": "http://localhost:8080/hook2",
-			"auth": map[string]any{
-				"type":   "api_key",
-				"config": json.RawMessage(`{"in":"header","name":"my-header","value":"my-value"}`),
-			},
-		})
+		c.MustSet(ctx, key, `
+{
+	"url": "http://localhost:8080/hook2",
+	"auth": {
+		"type": "api_key",
+		"config": {
+			"in": "header",
+			"name": "my-header",
+			"value": "my-value"
+		}
+	}
+}`)
 		hc = getFunc(ctx)
 		require.NotNil(t, hc)
 		assert.EqualValues(t, "http://localhost:8080/hook2", hc.URL)
 		assert.EqualValues(t, "api_key", hc.Auth.Type)
-		assert.JSONEq(t, `{"in":"header","name":"my-header","value":"my-value"}`, string(hc.Auth.Config))
+		rawConfig, err := json.Marshal(hc.Auth.Config)
+		require.NoError(t, err)
+		assert.JSONEq(t, `{"in":"header","name":"my-header","value":"my-value"}`, string(rawConfig))
 	}
 }
 
diff --git a/oauth2/oauth2_auth_code_test.go b/oauth2/oauth2_auth_code_test.go
index f76712c8114..69e9d42e427 100644
--- a/oauth2/oauth2_auth_code_test.go
+++ b/oauth2/oauth2_auth_code_test.go
@@ -1006,8 +1006,12 @@ func TestAuthCodeWithDefaultStrategy(t *testing.T) {
 				reg.Config().MustSet(ctx, config.KeyTokenHook, &config.HookConfig{
 					URL: hs.URL,
 					Auth: &config.Auth{
-						Type:   "api_key",
-						Config: json.RawMessage(`{"in": "header", "name": "Authorization", "value": "Bearer secret value"}`),
+						Type: "api_key",
+						Config: config.AuthConfig{
+							In:    "header",
+							Name:  "Authorization",
+							Value: "Bearer secret value",
+						},
 					},
 				})
 
diff --git a/oauth2/oauth2_client_credentials_test.go b/oauth2/oauth2_client_credentials_test.go
index 34b260dc2b6..40696ac1238 100644
--- a/oauth2/oauth2_client_credentials_test.go
+++ b/oauth2/oauth2_client_credentials_test.go
@@ -290,8 +290,12 @@ func TestClientCredentials(t *testing.T) {
 				reg.Config().MustSet(ctx, config.KeyTokenHook, &config.HookConfig{
 					URL: hs.URL,
 					Auth: &config.Auth{
-						Type:   "api_key",
-						Config: json.RawMessage(`{"in": "header", "name": "Authorization", "value": "Bearer secret value"}`),
+						Type: "api_key",
+						Config: config.AuthConfig{
+							In:    "header",
+							Name:  "Authorization",
+							Value: "Bearer secret value",
+						},
 					},
 				})
 
diff --git a/oauth2/token_hook.go b/oauth2/token_hook.go
index 377d15d0004..d32cadd7e4d 100644
--- a/oauth2/token_hook.go
+++ b/oauth2/token_hook.go
@@ -71,20 +71,11 @@ func applyAuth(req *retryablehttp.Request, auth *config.Auth) error {
 
 	switch auth.Type {
 	case "api_key":
-		c := struct {
-			In    string `json:"in"`
-			Name  string `json:"name"`
-			Value string `json:"value"`
-		}{}
-		if err := json.Unmarshal(auth.Config, &c); err != nil {
-			return err
-		}
-
-		switch c.In {
+		switch auth.Config.In {
 		case "header":
-			req.Header.Set(c.Name, c.Value)
+			req.Header.Set(auth.Config.Name, auth.Config.Value)
 		case "cookie":
-			req.AddCookie(&http.Cookie{Name: c.Name, Value: c.Value})
+			req.AddCookie(&http.Cookie{Name: auth.Config.Name, Value: auth.Config.Value})
 		}
 	default:
 		return errors.Errorf("unsupported auth type %q", auth.Type)