The difference between X-Session-Token and ory_kratos_session lies in how Ory manages sessions for different types of clients: ### ory_kratos_session (Session Cookie) - Type: HTTP Cookie - Usage: Issued when a user authenticates via a browser-based flow. - Intended for: Browser-based applications (e.g., web apps, SPAs). - How it works: The session cookie is automatically sent with each HTTP request by the browser. Ory uses this cookie to identify and authenticate the user session. - Header: Sent in the

Cookie

HTTP header, e.g.,

Cookie: ory_kratos_session=...

- Security: Includes browser-specific security features like httpOnly and SameSite attributes. - Example:

curl -H "Cookie: ory_kratos_session=..." "https://$<http://PROJECT_SLUG.projects.oryapis.com/sessions/whoami|PROJECT_SLUG.projects.oryapis.com/sessions/whoami>"

[Check session status](https://www.ory.sh/docs/identities/sign-in/check-session-token-cookie-api) ### X-Session-Token (Session Token) - Type: Bearer Token (string) - Usage: Issued when a user authenticates via a native (non-browser) flow, such as mobile or desktop apps. - Intended for: Native applications or non-browser clients. - How it works: The session token must be explicitly included in the request, typically in the

Authorization: Bearer

or

X-Session-Token

HTTP header. - Header: -

Authorization: Bearer <session-token>

- or

X-Session-Token: <session-token>

- Security: Designed for environments where cookies are not practical or supported. - Example:

curl -H "Authorization: Bearer {your-session-token}" "https://$<http://PROJECT_SLUG.projects.oryapis.com/sessions/whoami|PROJECT_SLUG.projects.oryapis.com/sessions/whoami>"

[Check session status](https://www.ory.sh/docs/identities/sign-in/check-session-token-cookie-api) --- Summary: - Use ory_kratos_session (cookie) for browser-based apps. - Use X-Session-Token (token) for native or non-browser apps. Ory's

/sessions/whoami

endpoint accepts both, and will authenticate the user based on whichever is present in the request. This allows your API to support both browser and native clients seamlessly [toSession API reference](https://raw.githubusercontent.com/ory/kratos/master/spec/api.json), [Browser vs. native apps](https://www.ory.sh/docs/identities/native-browser).

@chilly-king-10285 How to get X-Session-Token from ory_kratos_session?

I'm sorry, but the knowledge sources do not contain information on how to obtain an X-Session-Token directly from an ory_kratos_session (session cookie). In Ory, session cookies and session tokens are issued separately depending on the type of client (browser vs. native), and for security reasons, you cannot break the isolation between cookies and session tokens. There is no documented method to convert or extract an X-Session-Token from an ory_kratos_session cookie or vice versa [Session-management overview](https://www.ory.sh/docs/kratos/session-management/overview). If you need a token for API or native clients, you should authenticate using the native flow, which will issue a session token directly [Browser vs. native apps](https://www.ory.sh/docs/identities/native-browser).

When you log in using the browser flow in Ory, you receive an ory_kratos_session cookie, not an X-Session-Token. The session token (X-Session-Token) is only issued when you authenticate using the native (API) flow, which is intended for non-browser clients such as mobile or desktop applications. There is no documented way to obtain an X-Session-Token during a browser-based login session, and for security reasons, Ory does not allow converting a session cookie into a session token or vice versa [Session-management overview](https://www.ory.sh/docs/kratos/session-management/overview), [Browser vs. native apps](https://www.ory.sh/docs/identities/native-browser). If you require an X-Session-Token, you must use the native flow endpoints (e.g.,

/self-service/login/api

) instead of the browser flow endpoints (e.g.,

/self-service/login/browser

). The browser flow is designed to work with cookies, while the native flow is designed to work with tokens. Summary: You cannot obtain an X-Session-Token during a browser flow login session. Use the native flow if you need a session token.

Ory Kratos does not provide an equivalent to the Hydra access_token. Ory Kratos is focused on identity and session management (authentication), while Ory Hydra is responsible for OAuth2 and OpenID Connect flows, including issuing access tokens for API authorization. If you need an access token for API authorization (like the one issued by Hydra), you should use Ory Hydra or Ory Network's OAuth2 & OpenID Connect features. Kratos issues session cookies or session tokens for authentication, but these are not designed to be used as access tokens for API authorization. In fact, Ory explicitly recommends not using access or refresh tokens for session management and clarifies that Kratos is not an OAuth2 provider [What about access tokens / refresh tokens?](https://www.ory.sh/docs/security-model#what-about-access-tokens--refresh-tokens), [Why you probably do not need OAuth2 / OpenID Connect](https://www.ory.sh/blog/oauth2-openid-connect-do-you-need-use-cases-examples). Summary: - Hydra access_token: Used for API authorization (OAuth2). - Kratos session token/cookie: Used for authentication/session management, not for API authorization. If you need access tokens, use Ory Hydra or Ory Network's OAuth2 features, not Kratos.

The ability to convert Ory Sessions to JSON Web Tokens (JWTs) is documented as a feature in the Ory Network, which is Ory's commercial offering. The documentation provides detailed steps for configuring this feature using the Ory Network's CLI and APIs, and it assumes you have an Ory Network project running. There is no explicit mention in the knowledge sources that this feature is available in the open-source version of Ory Kratos. Therefore, based on the available information, this feature appears to be part of the Ory Network (paid/commercial) offering, not the open-source version [Convert Ory Sessions to JSON Web Tokens](https://www.ory.sh/docs/identities/session-to-jwt-cors). If you need this functionality in an open-source context, you may need to implement a custom solution or use Ory Oathkeeper as an API gateway to convert sessions to JWTs, as suggested in the documentation [Session-management overview](https://www.ory.sh/docs/kratos/session-management/overview#json-web-token-jwt-support).