Let your team see what users see — without passwords

Devora is a secure impersonation platform. Your support, engineering, and success teams access customer accounts to debug issues — with manager approval, time limits, and a complete audit trail.

No screen shares. No credential sharing. No unaudited backdoors.

Support & CS

Resolve tickets in minutes by seeing the exact issue in the user's account.

Engineering & QA

Reproduce bugs in real user context. Integrate with a few lines of code.

Managers

Approve every access request. Monitor active sessions. Revoke instantly.

Product

Understand user journeys and edge cases without scheduling screen shares.

CFO & Compliance

Full audit trail for SOC 2, GDPR, and enterprise security reviews.

app.devora.sh/impersonate
Devora Impersonation hub — stats, ready-to-impersonate requests, and approval queue

A few lines on each side

Add Devora to your existing app. Register three endpoints on your backend, initialize the frontend SDK, and your team can start requesting access. Follow the setup guide →

server.js Node.js
import { devoraSDK, DEVORA_ENDPOINTS } from '@devorash/sdk-node';
import { expressAdapter } from '@devorash/sdk-express';

const sdk = devoraSDK({ apiKey, secretKey, orgId });
await sdk.ready;

const routes = [
  sdk.register(DEVORA_ENDPOINTS.USER_SEARCH, async (req) => {
    // Search users by email, name, or ID
  }),

  sdk.register(DEVORA_ENDPOINTS.IMPERSONATE, async (req) => {
    // Generate session token for the target user
  }),

  sdk.register(DEVORA_ENDPOINTS.TERMINATE, async (req) => {
    // Invalidate the impersonation session
  }),
];

app.use('/devora', expressAdapter(sdk));
app.js JavaScript
import Devora from '@devorash/sdk-js';

await Devora.init({ apiKey: 'pk_client_live_xxx' });

Devora.onImpersonate(({ token, scope }) => {
  // Authenticate the impersonation session
  // Show impersonation banner in your UI
  // Enforce read-only scope on write operations
  // Redirect to your application
});

SDKs for Express, Fastify, Hono, React, Vue, Svelte, and vanilla JavaScript. View all packages →

Everything you need to impersonate securely

Not a backdoor button in your auth provider. A complete workflow — from request to session to audit log.

Impersonation Requests

Search for a user, set duration and scope, and submit a request with a reason. Routed to the right approver automatically.

Approval Workflows

Managers approve or reject before any session starts. Team-based routing. Admin override for urgent cases.

Revoke Access

Revoke approved requests or active sessions at any time. Terminates the session in your app immediately.

End Session

Agents end sessions from the dashboard or your app banner. Sessions also expire automatically when time runs out.

Session Recording

Privacy-masked recordings of impersonation sessions. Replay what happened for training, QA, and compliance.

User Search

Live search across your user base from the Devora dashboard. Find users by email, name, or ID in real time.

Time-Limited Sessions

Every session has a defined start and end. No forgotten access. Configurable maximum durations per role.

Read-Only & Write Scope

Read-only mode blocks mutations at the API level. Full write access only when explicitly approved.

Audit Logs

Who accessed whose account, when, why, and what they did. Exportable for SOC 2 and compliance reviews.

Active Session Monitoring

Real-time view of all live impersonation sessions. See who is in whose account right now.

Impersonation Banner

Visible indicator in your app during every session. Agents always know they are impersonating.

Team & Role Management

Organize by teams. Route approvals to the right managers. Control who can request write access.

From ticket to resolution

Three steps. No passwords. No screen shares.

01

Request access

Agent finds the user, sets duration and scope, and submits a request with context.

02

Get approved

Manager reviews and approves. Every request is tracked before access is granted.

03

Start solving

One click into the user's account. Banner visible. Scope enforced. Session recorded.

your-app.com
Customer application with Devora impersonation banner in read-only mode

Your app with the Devora SDK banner — agents always know they're in a session.

Common questions

How is this different from "Sign in as user" in auth providers?

Most auth providers offer an unaudited backdoor. Devora treats impersonation as a privileged workflow — with approval chains, time limits, scope restrictions, and complete audit trails.

Does this work with my existing auth system?

Yes. Devora works alongside Auth0, Clerk, Firebase, WorkOS, or custom auth. The SDK integrates at the API level and respects your existing authentication flow.

How long does integration take?

Most teams integrate in a few hours. Expose three backend endpoints, add the frontend SDK, and configure your Devora dashboard. See the setup guide.

Is this compliant with SOC 2 / GDPR?

Devora is designed for compliance. Audit trails, approval workflows, time-limited access, and scope restrictions support SOC 2, GDPR, and enterprise security requirements.

Ready to see what
your users see?

Request beta access to secure, auditable user impersonation. We'll review your request and onboard your team.

Documentation

No credit card required. We typically respond within a few business days.