diff --git a/README.md b/README.md
index 483292e..1bb33f8 100644
--- a/README.md
+++ b/README.md
@@ -28,8 +28,7 @@ Markdown file with frontmatter. Here is a contrived example:
 ---
 verify:
   hmac:
-    location: header
-    name: X-My-Header-Signature
+    header: X-My-Header-Signature
     secret: $MY_WEBHOOK_SECRET
 payload:
   contentType: json
@@ -113,13 +112,21 @@ handles `<basePath>/push`, and `github/push.lure` handles
 Specifies how to authenticate incoming webhook requests. Omit if the provider
 does not sign requests. Only one strategy may be specified.
 
-HMAC:
+HMAC (e.g. GitHub, GitLab — computes SHA-256 over the request body):
 
 ```yaml
 verify:
   hmac:
-    location: header  # or "query"
-    name: X-Hub-Signature-256  # header or query parameter name
+    header: X-Hub-Signature-256  # or query: param-name
+    secret: $ENV_VAR_NAME  # must be an environment variable reference
+```
+
+Literal (e.g. Forgejo, plain API key — compares value directly):
+
+```yaml
+verify:
+  literal:
+    header: Authorization  # or query: uid
     secret: $ENV_VAR_NAME  # must be an environment variable reference
 ```