diff --git a/service/config/sample.yml b/service/config/sample.yml
index a87c8d21c..33a1de23a 100644
--- a/service/config/sample.yml
+++ b/service/config/sample.yml
@@ -85,7 +85,7 @@ directory:
 
 directoryV2:
   client: # Configuration for interfacing with Contact Discovery Service v2 cluster
-    userAuthenticationTokenSharedSecret: # hex-encoded secret shared with CDS to generate auth tokens for Signal users
+    userAuthenticationTokenSharedSecret: # base64-encoded secret shared with CDS to generate auth tokens for Signal users
 
 messageCache: # Redis server configuration for message store cache
   persistDelayMinutes:
diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/configuration/DirectoryV2ClientConfiguration.java b/service/src/main/java/org/whispersystems/textsecuregcm/configuration/DirectoryV2ClientConfiguration.java
index 5f9f3c622..9d2ee263e 100644
--- a/service/src/main/java/org/whispersystems/textsecuregcm/configuration/DirectoryV2ClientConfiguration.java
+++ b/service/src/main/java/org/whispersystems/textsecuregcm/configuration/DirectoryV2ClientConfiguration.java
@@ -4,19 +4,23 @@
  */
 package org.whispersystems.textsecuregcm.configuration;
 
+import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
-import javax.validation.constraints.NotEmpty;
-import org.apache.commons.codec.DecoderException;
-import org.apache.commons.codec.binary.Hex;
+import org.whispersystems.textsecuregcm.util.ExactlySize;
 
 public class DirectoryV2ClientConfiguration {
 
-  @NotEmpty
-  @JsonProperty
-  private String userAuthenticationTokenSharedSecret;
+  private final byte[] userAuthenticationTokenSharedSecret;
 
-  public byte[] getUserAuthenticationTokenSharedSecret() throws DecoderException {
-    return Hex.decodeHex(userAuthenticationTokenSharedSecret.toCharArray());
+  @JsonCreator
+  public DirectoryV2ClientConfiguration(
+      @JsonProperty("userAuthenticationTokenSharedSecret") final byte[] userAuthenticationTokenSharedSecret) {
+    this.userAuthenticationTokenSharedSecret = userAuthenticationTokenSharedSecret;
+  }
+
+  @ExactlySize({32})
+  public byte[] getUserAuthenticationTokenSharedSecret() {
+    return userAuthenticationTokenSharedSecret;
   }
 
 }
diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/configuration/DirectoryV2Configuration.java b/service/src/main/java/org/whispersystems/textsecuregcm/configuration/DirectoryV2Configuration.java
index 5d60bf66b..afe069ca9 100644
--- a/service/src/main/java/org/whispersystems/textsecuregcm/configuration/DirectoryV2Configuration.java
+++ b/service/src/main/java/org/whispersystems/textsecuregcm/configuration/DirectoryV2Configuration.java
@@ -4,18 +4,21 @@
  */
 package org.whispersystems.textsecuregcm.configuration;
 
+import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import javax.validation.Valid;
-import javax.validation.constraints.NotNull;
 
 public class DirectoryV2Configuration {
 
-  @JsonProperty
-  @NotNull
-  @Valid
-  private DirectoryV2ClientConfiguration client;
+  private final DirectoryV2ClientConfiguration clientConfiguration;
 
+  @JsonCreator
+  public DirectoryV2Configuration(@JsonProperty("client") DirectoryV2ClientConfiguration clientConfiguration) {
+    this.clientConfiguration = clientConfiguration;
+  }
+
+  @Valid
   public DirectoryV2ClientConfiguration getDirectoryV2ClientConfiguration() {
-    return client;
+    return clientConfiguration;
   }
 }