Ory feature request and bug: • Ory Hydra Token Introspect should support OAuth2 Client Credentials Token not just Ory Cloud API Key (for security) • Ory Oathkeeper regex path match doesn't work if regex is specified for the entirety of the URL as in

url: "<.*>"

1. No because introspection is an internal endpoint, and anyone can register oauth2 clients - this is by design 2. That’s very strange - I saw two or three discussions / issues by you - which one is the one we should look at?

1. However, if someone access the proxy gaining access to the API key, they could in theory gain access to the rest of Ory cloud

1. We’re currently working on scoping API keys, so in the future they won’t be root credentials but you can say what they should be allowed to do. We’re still gathering customer info to understand what credentials are useful - I think this is a good example. @steep-lamp-91158 can we add this to the requirements? Making the API key able to “check oauth2 tokens” which allows e.g. token introspection? 2. thanks! can you please share what URLs you’re calling that aren’t being matched?

100%