Skip to main content
Mint a short-lived access token that acts as a service account, on behalf of the human calling this endpoint — see Service Accounts for the concept end to end.

​
POST /auth/core/impersonate

​
Request Body

​
Response

There is no refresh token. The token is single-shot by design — see Token Lifetime.

​
Errors

See Permissions below for who can call this endpoint at all.

​
Example

​
Permissions

Impersonation is the one operation on this page an org-scoped API key can never perform, unlike Create Account, List Accounts and Delete User: minting a token means naming one specific human as the actor, and a bare API key names no one.

​
Why This Endpoint Exists

The token this endpoint mints is the only way past the access perimeter — the ten operations a service account’s own key can never perform, from granting a membership to publishing a Blob. Every one of them asks whether there is a human behind the request; a key answers no, and a token minted here answers yes and names them. One narrow exception: minting an API key at an org or blob target is refused while acting, with 400 cannot_mint_while_acting, because such a key authenticates as whoever mints it and would record the impersonated account rather than the human. Mint those as yourself. Minting an account its own key, at target=user, is admitted — and is the whole point of a token from here. Minting one is itself on that perimeter, which is what keeps the hatch unreachable from inside: a service account’s key cannot mint the first token, and an acting token cannot mint a second, so a human starts every chain. Whatever the token then does is attributable to the human named in it, for its full 60 minutes.

​
Token Lifetime

The token lasts 60 minutes and is single-shot — minting it creates nothing a second call could revoke. Because it is a stateless JWT, there is no server-side state to clear early: the 60-minute expiry is the only control there is. Treat a minted token as sensitive for its full lifetime, the same as any bearer token.