I have a slightly odd use case. We are currently using passwordless auth on our public app and all works fine. We also have an “admin” app that uses its own auth. An admin user needs to be able to login to the admin app and then “login as” a public user. I was hoping there would be some way our backend could generate a session token and return it to the admin app client, which could then open a new browser tab logged in on behalf of the public user. Can someone advise the best way todo this?

Hey @PitchAsh

Is there an exmaple / any source code I can use for reference that will help?

Unfortunately not yet.

Can you give me any more info on how to get started?

Uhmmm. I’m not sure what you mean by “more info”. The flow I laid out on top should be clear enough? Do you have any specific questions about this?

How do I create the token

Secure random generator. You can google how to use one in your language. There will be tons of SO answers for that.

Ok, so this isnt part of the secure tokens itself

It’s a completely different token. One that you need to generate, validate and manage

ok.. so assuming ive created this token.. and passed it to the client.. the client then calls another besoke endpoing on the public app nackend to login using this one time token..

You can even just generate a JWT using our session recipe. The JWT can have the target user id in it

the public app is currently using the passwordless recipie

The admin client opens the public app’s client in a new tab with the token as a query param

what would the endponit need todo to retrieve the supertoken user, create a sessoin, and return it ?

That public app then sends that token to its api layer which creates a new session

there is a getUserByEmail... so i can get the userId fine

If u can tell me the associated domains, I can explain it in more detail

appInfo: { appName: 'MyPetPortal', apiDomain: config.app.baseApiUrl, // "https://gateway-dev.mypetportal.co.uk", websiteDomain: config.payment.baseUrl, // "https://pay-dev.mypetportal.co.uk", apiBasePath: '/api/v1/public/auth', websiteBasePath: '/auth' },

So that’s the public app?

thats the piublic app

Ok.

api is the same https://gateway-dev.mypetportal.co.uk/

I see.

yes

Well. So what you want to do is to add to update the access token payload to add some key to enable impersonation. And in there you can add the userId being impersonated. Then in your public app’s API, when you get the userId from the sesion, you check if session.getAccessTokenPayload() contains the impersonate userId and if it does, use tha instead

Yes I’m going to try that now

You might want to enable sub domain session sharing

Thanks

It’s called sessionScope setting on the frontend