For oathkeeper, I need to accept two different auth tokens for the same service, JWT and Kratos session token, how do I write my rule(s)? Do authenticators have “or” logic? or do I need to write the same rule twice or something else?

oathkeeper will go down your authenticators list until it finds a request that matches, so as long as those tokens use different headers you can use both

🤔