Hi, can an Access Key (with the "Impersonate" permission) impersonate a user via the backend SDK? Does it require consent? I'm trying and getting

[E013009] Internal server error [Status-Code:404]

tokenString, err := h.dc.Management.JWT().Impersonate(
  ctx,
  callerID,        // <- passing access key ID here
  targetUser,      // <- tried both user ID as well as user's login ID (Email)
  false,           // <- validateConcent=false (btw you have a typo here...)
  nil,             // <- customClaims set to nil
  orgID,           // <- tenant ID where the user has a "Member" role; access key has "Impersonate" permission (tried globally and in same tenant)
  300,             // <- 5min
)

What am I doing wrong? Perhaps access keys cannot impersonate?

@Arik Kfir, on the backend, I'm seeing that it's failing to load the impersonating user. From your comments, it looks like you are using an access key ID as the actor, and I do see the

user_id

passed starting with a K, which indicates a access/mgmt key. You need to have a legitimate user with the impersonation right associated with it.

Yeah I've been going through multiple iterations, until realizing that access keys cannot impersonate users, only other users can (with the

Impersonate

permission). Would be great if that was mentioned in the docs (unless I missed it...) I eventually landed on just using another user for the impersonation. For what it's worth, we're using this so microservice A working in the background, runs operation on behalf of user X... so our way to "scope" the operation is to make sure it runs with user X's permissions - by impersonating it. If there's a better way to do this, I'd love to hear about it.

A. @Kevin Gao @Mrunank Pawar Doc feedback on impersonation clarity. B. @Kevin Gao @Mrunank Pawar this kind of sounds like a use case for consent with inbound apps and user tokens right?

@Arik Kfir so if you want to impersonate a user and use their JWT with all of their associated permissions with said microservice, you can just create the JWT with the function that you're trying to using a management key instead of an Access Key. And then pass said JWT to that microservice backend and all of the permissions of the user will be able to be used. Any reason why you want to use an Access Key vs a Management Key, is this within your own organization?

So if I just pass the management key instead of the access key to the impersonate SDK function it would work? Or are you referring to a different method to create a JWT? The reason I wanted to use the access key is that I thought about it as an "identifier of the microservice", sort of like its identity ("I am microservice A") and it wants to call microservice B on behalf of user X, so sending a JWT of user X to microservice B seemed like the safest option to make sure B cannot do anything the user cannot do...