This OCTET STRING, up to 256 bytes, is described as an inbound ESP authentication key used by this Manual Crypto Map, a separate key used to verify integrity of received ESP packets independent of the encryption key. An admin configures this alongside the inbound ESP key when the chosen transform set uses combined encryption-plus-authentication, since omitting or mismatching it breaks integrity checking even if decryption itself would have worked. For example, an admin using an ESP transform with HMAC authentication would set this to the shared authentication secret matching the peer's outbound ESP auth key.