diff --git a/sdk/gen/auth_connect.ts b/sdk/gen/auth_connect.ts
index 22d15cb..873b76c 100644
--- a/sdk/gen/auth_connect.ts
+++ b/sdk/gen/auth_connect.ts
@@ -23,5 +23,6 @@ export const AuthService = {
       O: ValidateSessionResponse,
       kind: MethodKind.Unary,
     },
-  },
+  }
 } as const;
+
diff --git a/sdk/gen/auth_pb.ts b/sdk/gen/auth_pb.ts
index 530bc2b..714cafa 100644
--- a/sdk/gen/auth_pb.ts
+++ b/sdk/gen/auth_pb.ts
@@ -3,14 +3,7 @@
 /* eslint-disable */
 // @ts-nocheck
 
-import type {
-  BinaryReadOptions,
-  FieldList,
-  JsonReadOptions,
-  JsonValue,
-  PartialMessage,
-  PlainMessage,
-} from "@bufbuild/protobuf";
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
 import { Message, proto3 } from "@bufbuild/protobuf";
 
 /**
@@ -33,37 +26,19 @@ export class ValidateSessionRequest extends Message<ValidateSessionRequest> {
     { no: 1, name: "token", kind: "scalar", T: 9 /* ScalarType.STRING */ },
   ]);
 
-  static fromBinary(
-    bytes: Uint8Array,
-    options?: Partial<BinaryReadOptions>,
-  ): ValidateSessionRequest {
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ValidateSessionRequest {
     return new ValidateSessionRequest().fromBinary(bytes, options);
   }
 
-  static fromJson(
-    jsonValue: JsonValue,
-    options?: Partial<JsonReadOptions>,
-  ): ValidateSessionRequest {
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ValidateSessionRequest {
     return new ValidateSessionRequest().fromJson(jsonValue, options);
   }
 
-  static fromJsonString(
-    jsonString: string,
-    options?: Partial<JsonReadOptions>,
-  ): ValidateSessionRequest {
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ValidateSessionRequest {
     return new ValidateSessionRequest().fromJsonString(jsonString, options);
   }
 
-  static equals(
-    a:
-      | ValidateSessionRequest
-      | PlainMessage<ValidateSessionRequest>
-      | undefined,
-    b:
-      | ValidateSessionRequest
-      | PlainMessage<ValidateSessionRequest>
-      | undefined,
-  ): boolean {
+  static equals(a: ValidateSessionRequest | PlainMessage<ValidateSessionRequest> | undefined, b: ValidateSessionRequest | PlainMessage<ValidateSessionRequest> | undefined): boolean {
     return proto3.util.equals(ValidateSessionRequest, a, b);
   }
 }
@@ -102,47 +77,24 @@ export class ValidateSessionResponse extends Message<ValidateSessionResponse> {
   static readonly fields: FieldList = proto3.util.newFieldList(() => [
     { no: 1, name: "valid", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
     { no: 2, name: "uuid", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    {
-      no: 3,
-      name: "scopes",
-      kind: "scalar",
-      T: 9, /* ScalarType.STRING */
-      repeated: true,
-    },
+    { no: 3, name: "scopes", kind: "scalar", T: 9 /* ScalarType.STRING */, repeated: true },
     { no: 4, name: "error", kind: "scalar", T: 9 /* ScalarType.STRING */ },
   ]);
 
-  static fromBinary(
-    bytes: Uint8Array,
-    options?: Partial<BinaryReadOptions>,
-  ): ValidateSessionResponse {
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ValidateSessionResponse {
     return new ValidateSessionResponse().fromBinary(bytes, options);
   }
 
-  static fromJson(
-    jsonValue: JsonValue,
-    options?: Partial<JsonReadOptions>,
-  ): ValidateSessionResponse {
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ValidateSessionResponse {
     return new ValidateSessionResponse().fromJson(jsonValue, options);
   }
 
-  static fromJsonString(
-    jsonString: string,
-    options?: Partial<JsonReadOptions>,
-  ): ValidateSessionResponse {
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ValidateSessionResponse {
     return new ValidateSessionResponse().fromJsonString(jsonString, options);
   }
 
-  static equals(
-    a:
-      | ValidateSessionResponse
-      | PlainMessage<ValidateSessionResponse>
-      | undefined,
-    b:
-      | ValidateSessionResponse
-      | PlainMessage<ValidateSessionResponse>
-      | undefined,
-  ): boolean {
+  static equals(a: ValidateSessionResponse | PlainMessage<ValidateSessionResponse> | undefined, b: ValidateSessionResponse | PlainMessage<ValidateSessionResponse> | undefined): boolean {
     return proto3.util.equals(ValidateSessionResponse, a, b);
   }
 }
+
diff --git a/sdk/hono.ts b/sdk/hono.ts
index ee8f825..3f7bfcd 100644
--- a/sdk/hono.ts
+++ b/sdk/hono.ts
@@ -10,6 +10,18 @@ import type { AuthSdk, InvalidationHandler } from "./mod.ts";
  */
 export function createAuthMiddleware(sdk: AuthSdk) {
   return async (c: Context, next: Next) => {
+    // 1. Check Traefik ForwardAuth Ingress Headers first
+    const forwardedUserId = c.req.header("X-Forwarded-User-Id") ||
+      c.req.header("x-forwarded-user-id");
+    if (forwardedUserId) {
+      const rawScopes = c.req.header("X-Forwarded-Scopes") ||
+        c.req.header("x-forwarded-scopes") || "";
+      const scopes = rawScopes.split(",").map((s) => s.trim()).filter(Boolean);
+      c.set("userId", forwardedUserId);
+      c.set("scopes", scopes);
+      return await next();
+    }
+
     let token = getCookie(c, "session_id");
 
     if (!token) {