Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

I have configured Hydra webhooks via environment variables in docker:

```- OAUTH2_TOKEN_HOOK_AUTH_TYPE=api_key
- OAUTH2_TOKEN_HOOK_AUTH_CONFIG_IN=header
- OAUTH2_TOKEN_HOOK_AUTH_CONFIG_NAME=foo
- OAUTH2_TOKEN_HOOK_AUTH_CONFIG_VALUE=bar```
My webhook is being called, but without the specified header. changing the AUTH_TYPE to somethign else does yield an error, so hydra is parsing the config, at least that one. There is no validation on the other three parameters, so I cannot test whether they are correctly parsed or not.

I've looked through the code of 2.3.0 (the version I'm currently testing with), but I couldn't spot a bug there.

Weirdly, setting this works:
```- OAUTH2_TOKEN_HOOK_AUTH_CONFIG={"in":"header","name":"foo","value":"bar"}```
I did raise an issue on GitHub for this:
<https://github.com/ory/hydra/issues/3959>