Impersonate Customer

This is the API equivalent of the datagrid's Login as Customer action. It returns a short-lived customer Bearer token the admin can use to act as the customer against the storefront API.

Overview

See the Customers menu overview for the full feature flow.

All admin endpoints require an admin Bearer token — see Authentication.

Endpoint	Method
/api/admin/customers/{customerId}/impersonate	POST

Response fields

Field	Type	Notes
token	string	The customer Bearer token. Returned once — store it immediately.
customerId	integer	The impersonated customer.
customerEmail	string
customerName	string
impersonatedByAdminId	integer	The admin who issued the token (audit).
expiresAt	string	Expiry timestamp — the token is valid for 1 hour.

Token expires in 1 hour

The plaintext token is returned only once and cannot be retrieved again. Use it as a regular customer Bearer against the /api/shop/* endpoints to act as the customer.

Permission: customers.customers.edit.