Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hi! I need help configuring a self-hosted Zero Trust setup with Ory (Kratos + Oathkeeper) and a Next.js frontend using Ory Elements.
Here’s the situation:
 Oathkeeper is the only public entry point (`<http://127.0.0.1:4455>`), and the frontend runs in Docker. Everything works in the browser, but SSR and API routes inside the container can’t reach `127.0.0.1:4455` because it points to the container itself.
My question is:
 What’s the correct way to configure Next.js + Ory Elements so that:
• the browser uses the public Oathkeeper URL (for cookies and redirects),
• while SSR and server-side code can use an internal service URL (`<http://oathkeeper:4455/>...`) without breaking self-service flows?
I’m looking for real-world config examples (`NEXT_PUBLIC_ORY_SDK_URL`, a separate internal URL for SSR, access rules) or a recommended pattern for this kind of setup.
Any working examples or repo links would be greatly appreciated.

joined the slack to ask exactly the same question…