Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hello everyone. I am trying to figure out why my session doesn't contain the `credentials` property (inside identity) as described <https://www.ory.sh/docs/kratos/reference/api#tag/frontend/operation/toSession|here> after logging in?

Hello <@U06MA9G44SY>

I think that is an issue in the docs here - the session payload does not contain credentials.
<@U03RSG5ST1Q> I think I saw this issue before, do you know where it comes from in the API docs?

the endpoint only returns basic information by design. As of now, there is no way to enable it to return the credentials as well. However, depending on your use case, you might use the <https://www.ory.sh/docs/kratos/reference/api#tag/identity/operation/getIdentity|getIdentity> admin operation to fetch the identity, which includes the credentials.

No I mean do you know why it is included in the API reference for toSession ?

because it's part of the identity spec, but we don't fetch the credentials from the database in the `toSession` call (as that's a relative expensive operation, and toSession needs to be fast).
Ideally we would adjust the spec to not include credentials here, as there is no way to fetch the credentials.