Hi I have an issue with impersonation 1 I have a backend end AuthTown #ask-a-descoper

Hi, I have an issue with impersonation: 1. I have ...

Stanislav Kryvytskyi

03/31/2026, 4:15 PM

Hi, I have an issue with impersonation: 1. I have a backend endpoints to impersonate and stop impersonation 2. On impersonate I call

refresh

with refresh token from /impersonate response. 3. After that everything works fine except 2 issues:

useUser

still returns original user data and even calling

me()

doesn't fix it (

auth/me

returns original user) and after page refresh impersonation stop working I have

persistTokens

in AuthProvider. Could somebody help ?

✅ 1

DevRev

03/31/2026, 4:15 PM

Hi, I'm Descope's AI assistant. I've put together an initial response below based on your question. A member of the support team will take over and follow up shortly. Issue Summary You are experiencing issues with impersonation in your application. Specifically, after calling the

refresh

method from the

useDescope

hook, the

useUser

still returns the original user data, and the

auth/me

endpoint does not reflect the impersonated user. Additionally, impersonation stops working after a page refresh. Steps to Reproduce 1. Call the impersonate endpoint. 2. Use the

refresh

method from the

useDescope

hook. 3. Check the output of

useUser

and

auth/me

endpoint. Potential Solutions • Ensure that the

persistTokens

option in the

AuthProvider

is correctly configured to maintain the impersonation state across page refreshes. • Verify that the impersonation logic correctly updates the user context after the

refresh

call. • Consider implementing a state management solution to handle user data updates more effectively after impersonation. Next Steps If the above suggestions do not resolve your issue, please provide additional details about your implementation, including any relevant code snippets. This will help the support team assist you more effectively. Conclusion Thank you for your patience. A member of the Descope support team will follow up shortly to assist you further.

Stanislav Kryvytskyi

03/31/2026, 4:17 PM

Copy code

export const useImpersonateUser = () => {
  const queryClient = useQueryClient();
  const navigate = useNavigate();
  const { startImpersonation } = useImpersonationStore();
  const { refresh } = useDescope();
  return useMutation({
    mutationFn: async ({ userEmail }: { userEmail: string }) => {
      const originalToken = getRefreshToken();
      const response = await impersonationApi.impersonate({
        user_email: userEmail,
      });
      return { response, originalToken };
    },
    onSuccess: async ({ response, originalToken }, { userEmail }) => {
      startImpersonation(originalToken, userEmail);
      await refresh(response.refresh_jwt);
      queryClient.clear();
      await navigate({
        to: '/stores',
      });
    },
  });
};

Nick Rodriguez

03/31/2026, 10:13 PM

Hi Stanislav, Thanks for the detailed context and code snippet. This helps a lot. I've identified two likely issues in how the impersonated session is being activated in the React SDK after calling

refresh()

. Issue 1 —
useUser
not updating: Calling

refresh(impersonated_refresh_jwt)

exchanges the token for a new session, but the SDK's internal user state (which

useUser

subscribes to) may not automatically update from the refresh call alone. You'll need to explicitly call

<http://sdk.me|sdk.me>()

after the refresh to force the SDK to fetch and populate the impersonated user's data. Try updating your

onSuccess

handler like this:

Copy code

onSuccess: async ({ response, originalToken }, { userEmail }) => {
  startImpersonation(originalToken, userEmail);
  await refresh(response.refresh_jwt);
  await <http://sdk.me|sdk.me>(); // force user context to update to impersonated user
  queryClient.clear();
  await navigate({ to: '/stores' });
},

Issue 2 — Impersonation lost on page refresh: With

persistTokens: true

, the SDK stores the refresh token in localStorage and uses it to re-initialize the session on page load. If

refresh(impersonated_jwt)

doesn't write the impersonated refresh token into storage (only uses it for the exchange), the original refresh token remains, and the original session is restored on reload. To confirm this, could you check your browser's localStorage after calling impersonate — specifically, whether the refresh token key (typically

DSR

) has been updated to reflect the impersonated user? Depending on what you find there, the fix may be to explicitly store the impersonated refresh token before navigating. Can you confirm the SDK version you're using as well?

Stanislav Kryvytskyi

04/01/2026, 8:06 AM

@Nick Rodriguez Issue 1: I've tried everything, including calling

me()

after refresh, it returns original user data.

Stanislav Kryvytskyi

04/01/2026, 8:37 AM

Issue 2: I checked DSR in local storage and during impersonation it's still the same user (impersonator). But

getSessionToken

returns impersonated returns correct user (impersonated)

Stanislav Kryvytskyi

04/01/2026, 8:42 AM

React SDK 2.27.1

4 Views

Open in Slack

Previous Next