(1)

ONION_CLIENT_AUTH_ADD

is most clear... ONION (ok, what about onion),
CLIENT (ok, what about client), AUTH (ok, and...)
ADD (aha yes do that). And docs are self
ordering into nice sections.


ONION_CLIENT_ADD_AUTH

doesn't follow because it reverses the
last two thus breaking things again.

That's cool. But according to what dgoulet proposed, if we use both ONION_CLIENT_AUTH_ADD
and ONION_SERVICE_AUTH_ADD. The latter will sound like it's an authentication of the service not the client. At least for me :)

If you want the least specific left and the most specific right, I think ONION_AUTH_CLIENT_ADD and
ONION_AUTH_SERVICE_ADD would be better.

(2)

I think, to be more specific, I would rather use X25519PubKey and X25519PrivKey instead of just X25519Key.

(3)

Is PERMANENT a type? Is there any other type other than PERMANENT? I think I consider it as a TRUE/FALSE flag.