Impersonate Customer (GraphQL)

Issues a customer token an admin can use to act as the customer against the storefront API. This is the headless equivalent of the datagrid's "Login as Customer" action.

One-hour expiry, plaintext shown once

The plaintext token is returned only in this response — store it immediately. The token expires one hour after issue and is audited as having been issued by the calling admin (impersonatedByAdminId).

Permission: customers.customers.edit.

TIP

See the Impersonate overview for how this flow works.

All admin operations require an admin Bearer token — see Authentication.