Integrating Ory Hydra and Ory Kratos involves setting up each service individually and then configuring them to work together. For Ory Kratos, you can follow the [quickstart guide](https://www.ory.sh/docs/kratos/quickstart#quickstart-configuration) which provides a simplified configuration. The configuration file can be found in the [Kratos GitHub repository](https://github.com/ory/kratos/blob/master/contrib/quickstart/kratos/email-password/kratos.yml). For Ory Hydra, you can follow the [Hydra 5 Minute Tutorial](https://www.ory.sh/hydra/docs/5min-tutorial) to get started. To integrate Ory Kratos with Ory Hydra, you can follow the [Ory Kratos & Ory Hydra integration guide]() video tutorial. Please note that the specific configuration details will depend on your application's requirements and the environment in which you're deploying these services. For more complex scenarios, you might want to consider using Ory Network, which provides a managed service offering planet-scale and low latency APIs for login, registration, permissions, delegation (OAuth2 / OpenID Connect), and many more features. It combines Ory's open-source projects with an effortless and scalable infrastructure. You can find more information about Ory Network [here](https://www.ory.sh/).

I'm sorry, but the specific cURL commands used in the [Ory Kratos & Ory Hydra integration guide]() video are not provided in the knowledge sources I have. However, I can provide some examples of cURL commands used in Ory Kratos for various operations: 1. Submit Registration Flow:

bash curl -X POST \       -H 'Content-Type: application/json' \       -H 'Accept: application/json' \       -d '{"method":"password","csrf_token":"your-csrf-token","traits.email":"[email protected]","password":"verystrongpassword","traits.tos":"true","transient_payload.consents":"newsletter,usage_stats"}' \       -b cookies.txt \       -c cookies.txt \       "https://$<http://PROJECT_SLUG.projects.oryapis.com/self-service/registration?flow=<your-flow-id|PROJECT_SLUG.projects.oryapis.com/self-service/registration?flow=<your-flow-id>>"

[Source](https://www.ory.sh/docs/kratos/bring-your-own-ui/custom-ui-basic-integration#submit-registration-flow) 2. Fetch Existing Flows:

bash curl -X GET \       -H 'Content-Type: application/json' \       "https://$<http://PROJECT_SLUG.projects.oryapis.com/self-service/login/flows?id=<your-flow-id|PROJECT_SLUG.projects.oryapis.com/self-service/login/flows?id=<your-flow-id>>"

[Source](https://www.ory.sh/docs/kratos/bring-your-own-ui/custom-ui-basic-integration#fetch-existing-flows) 3. Session Checks:

bash curl -X GET \       -H 'Content-Type: application/json' \       -H 'Accept: application/json' \       -H 'Authorization: Bearer <your-session-token>' \       https://$<http://PROJECT_SLUG.projects.oryapis.com/sessions/whoami|PROJECT_SLUG.projects.oryapis.com/sessions/whoami>

[Source](https://www.ory.sh/docs/kratos/bring-your-own-ui/custom-ui-basic-integration#session-checks) Please replace the placeholders like

<your-flow-id>

,

<your-session-token>

, and

$PROJECT_SLUG

with your actual values. Also, please note that these are examples and might need to be adjusted based on your specific use case and setup.

Yes, Ory Kratos sessions can be used to maintain the authenticated state of a user, thereby bypassing the need for re-authentication for every request. When a user authenticates, they receive a session which serves as proof that the user is authenticated. This session allows the user to interact with the system without the need to re-authenticate for every request. Sessions can be issued in two formats: - Ory Session Cookie: When the system detects that the interaction is performed through a web browser, a cookie representing the user's session is stored in the browser. - Ory Session Token: When the system detects that the interaction is performed by a client other than a web browser, for example, a native mobile app, a session token is issued to the client. You can also convert an Ory Session to a JWT. However, for security reasons, you can't break the isolation between cookies and session tokens. Here is an example of how to use the Ory SDK to check a session:

javascript import { Configuration, FrontendApi } from "@ory/client"      const frontend = new FrontendApi(     new Configuration({       basePath: `https://${process.env.ORY_PROJECT_SLUG}.<http://projects.oryapis.com|projects.oryapis.com>`,     }),   )      export async function checkSession(sessionId: string, token: string) {     return await frontend.toSession({       xSessionToken: token,     })   }

And here is an example of how to use cURL to check a session:

bash curl -X GET \       -H 'Content-Type: application/json' \       -H 'Accept: application/json' \       -b cookies.txt \       https://$<http://PROJECT_SLUG.projects.oryapis.com/session/whoami|PROJECT_SLUG.projects.oryapis.com/session/whoami>

Please replace

$PROJECT_SLUG

with your actual project slug. For more information, you can refer to the [Kratos Session Management Overview](https://www.ory.sh/docs/kratos/session-management/overview) and the [Kratos Custom UI Integration Basics](https://www.ory.sh/docs/kratos/bring-your-own-ui/custom-ui-basic-integration#session-checks) documentation.

i'm want to use the hydra-kratos flow on mobile app (native not webview)

@chilly-king-10285, I try to create Native Login Flow on Kratos, I got the flow_id and already successfully authenticated and got the session token. How i can continue the flow on Hydra?

Once you have successfully authenticated with Ory Kratos and obtained a session token, you can use this session token to authenticate requests to Ory Hydra. However, it's important to note that Ory Kratos and Ory Hydra serve different purposes and are not directly linked in terms of user sessions. Ory Kratos handles identity management (including user registration, login, account recovery, etc.), while Ory Hydra handles OAuth 2.0 and OpenID Connect flows. To continue the flow on Hydra, you would typically initiate an OAuth 2.0 or OpenID Connect flow, which involves redirecting the user to Hydra's authorization endpoint. The specifics of this process will depend on the exact OAuth 2.0 or OpenID Connect flow you're using (e.g., Authorization Code Flow, Implicit Flow, etc.). Here's a general example of how you might initiate an Authorization Code Flow with Hydra:

bash # Redirect the user to this URL https://<your-hydra-url>/oauth2/auth?response_type=code&client_id=<your-client-id>&redirect_uri=<your-redirect-uri>&scope=openid+offline

After the user authenticates and approves the consent request, they will be redirected back to your application with an authorization code, which you can exchange for an access token and ID token. Please replace

<your-hydra-url>

,

<your-client-id>

, and

<your-redirect-uri>

with your actual values. For more information on how to use Ory Hydra, you can refer to the [Hydra 5 Minute Tutorial](https://www.ory.sh/hydra/docs/5min-tutorial) and the [OAuth2 and OpenID Connect Flows](https://www.ory.sh/hydra/docs/concepts/oauth2) documentation.

Yes, you're correct. In a typical setup, you would initiate the Authorization Code Flow with PKCE in Ory Hydra, which would then redirect the user to the login page managed by Ory Kratos. Once the user has successfully authenticated with Kratos, you would need to redirect the user back to Hydra with the authentication success status. Hydra would then proceed with the consent flow (which could be handled by another service or the same service handling authentication). After the consent flow, Hydra will redirect back to your application with an authorization code. Your application can then exchange this authorization code for an access token and ID token by making a POST request to Hydra's token endpoint. Here's a general example of how you might exchange the authorization code for tokens:

bash curl -X POST \   https://<your-hydra-url>/oauth2/token \   -H 'Content-Type: application/x-www-form-urlencoded' \   -d 'grant_type=authorization_code&client_id=<your-client-id>&client_secret=<your-client-secret>&code=<authorization-code>&redirect_uri=<your-redirect-uri>'

Please replace

<your-hydra-url>

,

<your-client-id>

,

<your-client-secret>

,

<authorization-code>

, and

<your-redirect-uri>

with your actual values. For more information on how to use Ory Hydra, you can refer to the [Hydra 5 Minute Tutorial](https://www.ory.sh/hydra/docs/5min-tutorial) and the [OAuth2 and OpenID Connect Flows](https://www.ory.sh/hydra/docs/concepts/oauth2) documentation.

@chilly-king-10285, how to skip the consent?

In certain scenarios, you may want to skip the consent screen and automatically grant consent to the client. This can be done by setting the

require_consent

property to

false

on the client configuration. Here is an example of how to do this:

bash ory create oauth2-client \     --skip-consent \     # ...

[Source](https://www.ory.sh/docs/oauth2-oidc/skip-consent) You can also configure it to skip the "consent screen" on a per-client basis through the Ory Console. Here are the steps to enable consent screen skipping for existing OAuth2 clients: 1. Go to OAuth 2 → OAuth2 Clients in the [Ory Console](https://console.ory.sh/projects/current/oauth). 2. Find the client for which you want to turn on consent skipping and click the [pencil icon] in the Actions column. 3. Use the Skip consent toggle in the Consent screen section to manage the feature. When you turn this feature on, consent skipping is enabled for the client. 4. Scroll back to the top and click Save. You can enable consent skipping when you create new OAuth2 clients. Use the Skip consent toggle in the Consent screen section to manage the feature. [Source](https://www.ory.sh/docs/oauth2-oidc/custom-login-consent/flow#skipping-consent-for-trusted-clients) If you're using TypeScript, you can use the following snippet to determine whether to skip the consent screen UI:

javascript const { consent_challenge } = req.query // the HTTP request      const challenge = await oauth2     .getOAuth2ConsentRequest({ consentChallenge: String(consent_challenge) })     .then(({ data: body }) => body)      const skipConsent =     challenge.skip || // skip because the user accepted the consent previously     challenge.client.skip_consent // skip because the client is trusted      if (skipConsent) {     // If the consent is skipped, we accept the consent request immediately.     await oauth2.acceptOAuth2ConsentRequest({       consentChallenge: String(consent_challenge),       acceptOAuth2ConsentRequest: {         grant_scope: challenge.requested_scope,         grant_access_token_audience: challenge.requested_access_token_audience,         session,       },     })   }

[Source](https://www.ory.sh/docs/oauth2-oidc/custom-login-consent/flow#implementation) Please note that not showing the consent screen will break OpenID Connect Certification. [Source](https://www.ory.sh/docs/oauth2-oidc/custom-login-consent/flow#previous-consent)

The behavior you're observing might be due to the way the login flow is initiated. When you initiate a login flow via the

/self-service/login/browser

endpoint in Ory Kratos, it's intended to be used in a browser context. This endpoint initializes a browser-based user login flow and sets the appropriate cookies and anti-CSRF measures required for browser-based flows. If this endpoint is opened as a link in the browser, it will be redirected to

selfservice.flows.login.ui_url

with the flow ID set as the query parameter

?flow=

. If a valid user session exists already, the browser will be redirected to

urls.default_redirect_url

unless the query parameter

?refresh=true

was set. However, if this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the context of integrating Ory Kratos with Ory Hydra, the login flow should be initiated by Hydra, which will then redirect the user to the Kratos login page. Once the user has successfully authenticated with Kratos, you would need to redirect the user back to Hydra with the authentication success status. If you're directly initiating the login flow via Kratos and expecting it to redirect back to Hydra, this might not work as expected because the flow wasn't initiated by Hydra in the first place. For more information, you can refer to the [Kratos API Reference](https://www.ory.sh/docs/kratos/reference/api) and the [Kratos User Login Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-login).

The

/self-service/login/api

endpoint in Ory Kratos is designed for API clients and clients without browsers. It doesn't use HTTP redirects and instead returns a JSON response. This is why it doesn't automatically redirect back to Hydra. Here's an example of the JSON response you would get:

bash curl -s -X GET \       -H "Accept: application/json"  \       <https://playground.projects.oryapis.com/self-service/login/api> | jq      {     "id": "9d17f37b-b60b-44f5-9812-4829a89810f7",     "type": "api",     "expires_at": "2021-07-09T11:26:04.019418543Z",     "issued_at": "2021-07-09T10:26:04.019418543Z",     "request_url": "<http://playground.projects.oryapis.com/self-service/login/api>",     "ui": {       "action": "<https://playground.projects.oryapis.com/self-service/login?flow=9d17f37b-b60b-44f5-9812-4829a89810f7>",       "method": "POST",       "nodes": [ /* ... */ ]     }   }

[Source](https://www.ory.sh/docs/kratos/self-service/flows/user-login#login-for-api-clients-and-clients-without-browsers) If you're using Hydra to initiate the login flow and then redirecting to Kratos, you should be using the

/self-service/login/browser

endpoint instead. This endpoint is designed for browser-based flows and will handle the necessary redirects. Once the user has successfully authenticated with Kratos, you would need to redirect the user back to Hydra with the authentication success status. The specifics of this process will depend on your application's setup and how you're handling the integration between Hydra and Kratos. For more information, you can refer to the [Kratos API Reference](https://www.ory.sh/docs/kratos/reference/api) and the [Kratos User Login Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-login).