I am using oathkeeper to protect our web api already. So far clients can only use the browser login flow. I now want to also enable the native flow for native applications. In the native flow, I get the session token, instead of the cookie session. How am I supposed to use this token (i.e., how to set it on the HTTP request) such that oathkeeper can authenticate and authorize my request. For the authenticators, I currently have:

cookie_session:
            enabled: true
            config:
              check_session_url: "{{ orgman_deploy_kratos_api_addr }}/sessions/whoami"
              preserve_path: true
              extra_from: "@this"
              subject_from: "identity.id"
              only:
                - ory_kratos_session

Do I simply also configure the

bearer_token

authenticator with:

bearer_token:
            enabled: true
            config:
              check_session_url: "{{ orgman_deploy_kratos_api_addr }}/sessions/whoami"
              preserve_path: true
              extra_from: "@this"
              subject_from: "identity.id"
              token_from:
                header: X-Session-Token

and set the token in the HTTP headers?

That's what we do. Different header though, but whatever you want to call it. 🙂