Introduction

Laravel Impersonation is a small, focused package for session-based user impersonation. An authenticated user (typically an admin) can temporarily act as another user; the package keeps a stack in the session so you can support nested impersonation when you need it.

Design goals

• Secure by default — optional HTTP routes are off until you enable them; package routes use web + auth middleware
• Explicit authorization — you supply a single authorize callback; nothing is allowed by default
• Flexible — swap user resolution, login, responses, and the manager itself
• Observable — events for starting, started, and finished, including a cancellable starting event

What it is not

• Not a UI or Filament/Nova plugin — wire your own buttons and redirects
• Not token-based or API-key impersonation — state lives in the session
• Not a permissions system — pair it with your existing gates/policies

When to use it

Reach for this package when support or admin staff need to “see the app as” another user without sharing passwords, and you want a clean Laravel-native API with events, middleware, and optional HTTP endpoints.

Continue to Installation.