What about this?

{
  "credential": {
    "username": "Dato",
    "password": "asd"
  }
}

BTW, you can drop most of the attributes, as those are the defaults anyway:

@rootPathFromName
interface IWeb {
  // POST /authenticate {"credential": ...}
  string authenticate(Credential credential);
}

To get the first POST body to work ({"username": "Dato", "password": "asd"}), you could use string authenticate(string username, string password); - or string authenticate(ValidUsername username, ValidPassword password); to get some automatic input validation.