Another question, is it possible to log the credentials that oathkeeper forwards to the backend services (after mutation)? I've configured

leak_sensitive_values

for debugging lower level environments but that doesn't seem to show the transformed token.

not really 😞

No worries, I'll add a route to our non-prod environments for returning the transformed credentials for troubleshooting/development purposes. Is enabling logging of transformed credentials on the roadmap or should I create an issue?

an issue please :) and if you have time a PR ;)