This message was deleted.

Your Approach is Correct Yes,

jwt.impersonate()

is the right API for server-side token generation . The impersonation API allows you to generate a JWT for a known user using a management key .

const resp = await descopeClient.management.jwt.impersonate(
  impersonatorId,    // Service account email
  loginId,           // Target user email  
  false,             // validateConsent
  customClaims,      // Optional custom claims
  tenantId           // Tenant ID
);

JWT Behavior and Claims The impersonated JWT behaves identically to normal login tokens . The response is a refresh JWT of the impersonated user . The

sub

claim is set to the impersonated user's ID . You can validate the impersonated session JWT using the Validate Session API endpoint . Scale Considerations • Use management keys for authentication:

Authorization: Bearer <ProjectId:ManagementKey>

• The impersonator user must have impersonation permission • Consider JWT expiration and refresh token handling for long-running sessions • Monitor usage in the Audit Trail by searching for "Impersonate" User Impersonation in Backend | Descope Documentation Impersonate User | API Reference | Descope Documentation Learn how to impersonate users | Descope Documentation Batch Delete Users | API Reference | Descope Documentation