Authenticate an impersonation token to impersonate a Member using the Stytch B2B API
Impersonate Member button.Basic authentication header of the form Basic <encoded-value>, where <encoded-value> is the base64-encoded string username:password.
Request type
The Member Impersonation token to authenticate. Expires in 5 minutes by default.
Successful response
Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
Globally unique UUID that identifies a specific Member.
Globally unique UUID that identifies a specific Organization. The organization_id is critical to perform operations on an Organization, so be sure to preserve this value.
The Member object
A secret token for a given Stytch Session.
The JSON Web Token (JWT) for a given Stytch Session.
The Organization object.
Successfully authenticating an impersonation token will never result in an intermediate session. If the token is valid, a full session will be created.
The member will always be fully authenticated if an impersonation token is successfully authenticated.
The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
The Session object for the impersonated Member.
MFA will not be required when authenticating impersonation tokens.