---
title: Log in as a customer
description: Open the customer portal as a specific customer for one hour to reproduce a problem — conditions, safeguards, and what is blocked and logged.
url: https://nexcmp.com/docs/customers/login-as/
applies_to: NexCMP 1.6.1
updated: 2026-11-02
---

# Log in as a customer

> **Where in the admin:** Customers › Customers › List › a customer › header button **Impersonate** (`/customers/<id>`).

## What it does

**Impersonate** (login-as) lets a support administrator see the portal exactly as one customer sees it, to reproduce a problem or help with an order. The session lasts one hour and is clearly separated from a normal session: anything that could give lasting access to the account is blocked, and every use is logged.

## Requirements

| Item | Requirement |
|---|---|
| Role | An administrator signed in to the admin console. |
| Customer | The account must be **active**. A locked or deleted account answers "account is not active" (HTTP 409). |
| Reason | A reason is mandatory; it is written to the audit log. |
| Browser | Allow pop-ups for the admin address: the portal opens in a new window. |

## Steps

1. Open **Customers › List** and click the customer.
2. Click **Impersonate**. A dialog explains that the customer's site opens as the customer for one hour and that every action is audited.
3. Type the **reason** (for example "Ticket 1234 — cannot create VM") and click **Open app**.
4. A new window opens on the customer's site and shows the dashboard with `?impersonated=1`. If the browser blocked the window, allow pop-ups and click again.

![Impersonate dialog with the reason field filled in](https://nexcmp.com/docs/images/customers/login-as-01-dialog.webp)

For a customer of a reseller, the window opens on the **reseller's own domain**, because the link only works on the customer's own site.

## How it works

1. The admin action creates a **single-use token** valid for one hour and writes `customer.login_as` (administrator, IP, reason, site) to the audit log.
2. The new window opens `https://<site>/v1/portal/impersonate/<token>`. A first request only shows a small page and does **not** consume the token (so browser prefetching cannot burn it); the page then confirms with a POST.
3. The POST consumes the token. A second use, or use after one hour, answers "The impersonation link has expired or was already used".
4. NexCMP creates a customer session that lasts **one hour** (a normal session lasts 30 days), records a sign-in entry with the method `impersonate`, and logs `customer.login_as.used`.
5. The token works only on the customer's own site; on another host it answers 404.

## What is blocked in an impersonated session

Anything that gives access beyond the hour, or changes the customer's own security, returns HTTP 403 `impersonate_forbidden`:

| Blocked | Why |
|---|---|
| Changing the password, TOTP, linking or unlinking Google/GitHub, editing passkeys | Customer's own credentials |
| Deleting the account | Irreversible |
| Creating or editing **API keys** | Long-lived access |
| Approving a CLI, desktop or MCP login (device link) | Long-lived access |
| Creating Kubernetes access, S3 keys, SSH keys, root passwords, console share links, VPN or proxy credentials | Secrets that outlive the session |
| Redeeming top-up codes | Money campaigns |
| Withdrawing or changing the payout of affiliate commission | Money leaves the system |
| Editing AI keys, budgets or alert e-mails | Customer configuration |

Everything else works: you can read the pages, create or manage VMs, place orders and so on. Actions run with the customer's identity and spend the customer's money; the audit entries above are what show that an administrator was behind the session.

## Verify

1. Impersonate a test customer. The portal opens and shows that customer's data.
2. Try to change the password: you get "forbidden" (impersonation).
3. In **System › Logs › Admin actions**, find `customer.login_as` with your name, the reason and the site, followed by `customer.login_as.used`.
4. Close the window, reopen the same link: "link expired or already used".

## Limits & notes

- The one-hour limit is fixed (3600 seconds). To continue, impersonate again.
- Prefer reading and reproducing; avoid actions that spend money unless the customer asked you to.
- Revoke the session early with **Revoke sessions** on the customer page (this signs the customer out too).
- Resellers have their own **Sign in to partner console** impersonation (60 minutes) from Resellers; see [Resellers](https://nexcmp.com/docs/customers/resellers/).

## Troubleshooting

| Symptom | Cause | Fix |
|---|---|---|
| "Account is not active" | Account locked or deleted | Unlock it first, or look at the customer page instead. |
| Browser blocks the window | Pop-up blocker | Allow pop-ups for the admin address and try again. |
| "Link expired or already used" | One-hour limit or reuse | Impersonate again. |
| Opens "Not found" | The link was used on the wrong host | Use the window the dialog opened; do not paste the link elsewhere. |
| An action says "forbidden" | Blocked in impersonated sessions | Ask the customer to do it, or use the admin screens. |