Hello. We're already using Ory Oathkeeper + Ory Network Hydra to enable authentication on our API via OAuth access tokens through the

oauth2_introspection

authenticator. We'd like to add support for API keys using the

bearer_token

where we'll validate against internal tools that can check the API keys.

Question: is it possible to have all the API consumers use the same header, and have Oathkeeper "fall through" to the next authenticator if the first one fails?

E.g. • Request comes through with

Authorization: Bearer <some-value>

• Oathkeeper attempts

bearer_token

◦ if it passes, request is allowed ◦ if it fails, it falls through to next authenticator • Oathkeeper attempts

oauth2_introspection

◦ if it passes, request is allowed ◦ if it fails, it request is denied