So, i'm planning on building a API service in Go and ofc i want to protect it. I'm reading up on Oathkeeper and that seems to be partly the right one, but it's just a front of my service. But what is the actual way of protecting my service, is it to use Keto in it so when my user login on the nextjs front through Kratos then with that have the permissions within my service ? or is it to implement some part of Kratos in my service?

You can use Oathkeeper to front your service as a way of enforcing certain rules that you configured (authenticators, authorizers). It allows you to abstract everything away from your service, and only forward a signed JWT to the service saying "this is the user, and they have these premissions". Whether that's a good fit for your use-case is up to you to decide. Oathkeeper can then call Kratos, Keto, ... to do the rule enforcement and token enrichment.

Ya, my point is that I just don't want "people" to send request to the api on the inside Lan and get data out. Then it can be comprised from that. So I basically just need to validate the token I guess

yes, validate the signature, and use some kind of network rules

🤔 as a sidecar hmmm