Impersonate Customer

Endpoint	Method
/api/admin/customers/{customerId}/impersonate	POST

Token expires in 1 hour

• Token name = "admin-impersonate:{adminId}" — searchable for audit.
• Abilities = ['*', 'impersonated-by-admin:{adminId}'].
• expires_at = now() + 1 hour — non-negotiable; aligns with short-lived assumed-identity windows.
• The plaintext token is returned once in the response body. There is no way to retrieve it again — store it immediately.
• Issuance is audit-logged via admin.customer.impersonate with {admin_id, customer_id, token_id, expires_at}.

Use the returned token as a regular customer Sanctum Bearer against /api/shop/* endpoints.

Permission: customers.customers.edit.