How do I make Oathkeeper use an session token from a header and validate it against kratos /whoami endpoint? This is my current configuration:

authenticators:
  bearer_token:
    enabled: true
    config:
      check_session_url: <https://mypath.projects.oryapis.com/sessions/whoami>
      token_from:
        header: Authorization
      preserve_path: true
      forward_http_headers:
        - Authorization

I pass my token in the auth header like

Authorization: <my-token>

But the response is always the same:

{
  "error": {
    "code": 401,
    "status": "Unauthorized",
    "message": "Access credentials are invalid"
  }
}

Hi @proud-ram-78226 I also found the

Authorization

header unreliable when working with bearer tokens, instead I opted for approach number 2 and use the

X-Session-Token

bearer_token:
    enabled: true
    config:
      check_session_url: http://<KRATOSURL>/sessions/whoami
      preserve_path: true
      extra_from: "@this"
      subject_from: "identity.id"
      token_from:
        header: X-Session-Token
      forward_http_headers:
        - Authorization
        - X-Session-Token

thank you very much! this did the trick

@proud-ram-78226 the auth header should be like that

Authorization: Bearer <token>

, as the Bearer is the auth scheme. Can you try it?