Login as Customer Pro
v1.7.2
Login as Customer Pro
- Updates and support included for 12 months
- License key delivered immediately by email
- 30-day money-back guarantee
- Full documentation included
- Compatible with Hyvä themes
- Composer-ready installation
Login As Customer
Help your customers faster by stepping directly into their account. This module lets your admin team open a real customer session in one click — from the customer grid, the order grid, the customer edit page, or a dashboard quick-search widget — so you can reproduce a checkout problem, debug a cart issue, or place an order on behalf of a customer without ever asking for their password.
Unlike Magento's built-in Login As Customer, this module is designed for teams that need to prove what happened during a support session. Every login is logged, every page visited can be recorded, and every action is gated behind granular ACL permissions and a configurable consent mode.
Who it's for
- B2B and B2C merchants whose support team regularly assists customers with carts, configurators, or complex orders
- Merchants subject to compliance or audit requirements (who logged in, when, for what reason, what was changed)
- Agencies and dev teams reproducing customer-reported bugs that only show up under a specific account context
Key benefits
- One-click access from customer grid, order grid, customer edit page, and a dashboard quick-search widget (search by name or email).
- Full audit trail — every session is logged with admin, customer, duration, pages visited, and orders placed during the session.
- Granular control — four dedicated ACL resources (login, view logs, convert guests, edit config), restricted customer groups, optional mandatory admin notes, and three consent modes (Always Allow / Ask Customer / Always Deny).
- Safe by design — short-lived authentication tokens, CSRF protection, automatic logout after inactivity (with countdown warning), and a sticky frontend banner so the admin never forgets they're impersonating.
- Guest order recovery — convert a guest order into a real customer account and log in, in a single action.
- Production-friendly — Varnish Full Page Cache stays active for normal traffic; the impersonation layer only kicks in when a session is detected. Debug logging is gated behind an admin toggle so production logs stay clean.
Compatibility
- Magento 2.4.x / Mage-OS equivalent
- PHP 8.1, 8.2, 8.3
- Requires
wimakeit/module-core3.0.9 or later - Works with Hyvä and Luma frontends (sticky banner adapts to both)
- Compatible with Varnish Full Page Cache
Install this module via Composer. Make sure your auth.json is configured with your Wimakeit credentials.
$ composer require wimakeit/module-login-as-customer:^1.7.2
$ bin/magento setup:upgrade
$ bin/magento setup:di:compile
Installation notes
The standard composer require + setup:upgrade + setup:di:compile flow applies. The points below cover what's specific to this module.
Required dependency
This module requires wimakeit/module-core 3.1.0 or later (for the admin tour runner). Composer will pull it automatically from the Wimakeit registry as long as the registry is declared in your project's composer.json.
ACL permissions
After installation, four new ACL resources are available under System → Permissions → User Roles:
| Resource | Default |
|---|---|
Wimakeit_LoginAsCustomer::login (use Login As Customer buttons) | granted to Administrator role only |
Wimakeit_LoginAsCustomer::log (view login activity log) | granted to Administrator role only |
Wimakeit_LoginAsCustomer::convert_guest (convert guest orders) | granted to Administrator role only |
Wimakeit_LoginAsCustomer::config (edit module configuration) | granted to Administrator role only |
Assign them to your support / customer-care roles as needed.
Configuration
The module ships with safe production defaults. Go to Stores → Configuration → Wimakeit → Login As Customer only if you want to change them.
General settings
| Setting | Default |
|---|---|
| Enable Module | Yes |
| Token Lifetime (seconds) | 30 |
| Disable Full Page Cache during impersonation | Yes |
| Show frontend Notification Banner | Yes |
| Show Admin Name (on sticky bar) | Yes |
| Show Session Timer | Yes |
| Show Inactivity Timeout Badge | Yes |
| Show Max-Session Countdown | Yes |
| Show "Return to Admin" Button | Yes |
| Show "Disconnect" Button | Yes |
| Require Admin Notes before login | No |
| Restricted Customer Groups | None |
| Customer Acceptance Mode | Always Allow |
| Store Selection Mode | Auto (customer's default store) |
Customer Acceptance Mode options: Always Allow (no consent needed) / Ask Customer (respect customer preference) / Always Deny (feature disabled).
Logging settings
| Setting | Default |
|---|---|
| Enable Activity Logging | Yes |
| Enable Session Recording (page-by-page) | Yes |
| Log Retention (days) | 90 |
| Enable Debug Logging | No — leave off in production |
Inactivity auto-logout
| Setting | Default |
|---|---|
| Inactivity Timeout | 15 minutes |
| Warning Countdown | 60 seconds |
Cron jobs (registered automatically)
| Job | Schedule |
|---|---|
wimakeit_lac_cleanup_tokens (purge expired tokens) | every 4 hours |
wimakeit_lac_cleanup_sessions (purge logs past retention) | daily at 2 AM |
No setup needed — just make sure Magento cron is running.
Optional: override the cookie signing key
The module signs its session-marker cookies with a key derived from Magento's encryption key. To override it (e.g. to share state across two installs), add to app/etc/env.php:
'wimakeit_lac' => [
'secret_key' => 'your-shared-secret',
],
If the key is not set, a per-installation key is derived automatically — no action required for standard installs.
- Version
- v1.7.2
- License
- Annual Subscription
- Support
- 12 months
- Last updated
- Jun 5, 2026
- Magento
- Magento 2.4.4 Magento 2.4.5 Magento 2.4.6 Magento 2.4.7 Mage-OS 2.0 Mage-OS 2.1
- PHP
- PHP 8.1 PHP 8.2 PHP 8.3
- Hyvä
- Compatible
- Package
-
wimakeit/module-login-as-customer
Compatibility checker
Pick your stack to see if this module fits.
Compatibility 4
Pricing & licensing 4
vendor/wimakeit/ once you composer require the package, so you can read it, audit it, and patch it locally for your own Magento install. You may NOT redistribute it, sublicense it, publish it on a public package registry, or sell it on. One licence = one production domain + one staging/dev domain (see terms for the full EULA). Wimakeit modules are NOT part of Magento's open-source repository on packagist.org — they are distributed exclusively via the private Composer registry packages.wimakeit.be. Installation & updates 6
composer require wimakeit/module-login-as-customer:^1.7.0, then bin/magento setup:upgrade, bin/magento setup:di:compile, and finally bin/magento cache:flush. The Installation tab on this page lists every configuration step (ACLs, cron jobs, default values) so a deploy takes minutes, not hours. If you need a hand, Wimakeit offers Magento installation services from our Wallonian office (Presles, between Charleroi and Namur). auth.json: {"http-basic": {"packages.wimakeit.be": {"username": "YOUR-EMAIL", "password": "YOUR-TOKEN"}}}. Step 3: register the repo: composer config repositories.wimakeit composer https://packages.wimakeit.be. Step 4: composer require wimakeit/module-login-as-customer:^1.7.0. In CI/CD pipelines, inject COMPOSER_AUTH as a JSON env var instead of committing auth.json. composer require, same module code, same database schema — no fork to maintain, no licence change. composer update is safe within a major. app/design/frontend/{YourVendor}/{theme}/Wimakeit_{Module}/templates/ keeping the same relative path. Blocks, ViewModels and Helpers are overridable via DI preference in your own custom module — declare <preference for="Wimakeit\…\OriginalClass" type="YourVendor\Override\Class" /> in etc/di.xml. Layout XML is extended (preferred) or overridden the standard Magento way. Wimakeit modules never use the final keyword on classes you might reasonably want to override — overriding is a first-class scenario, not a hack. Support & security 3
contact@wimakeit.com with the module name, version, Magento/Mage-OS version and the steps to reproduce. Fixes ship in the next patch release. Wimakeit support is staffed in French, English and Dutch on business days (CET working hours). contact@wimakeit.com with a clear [SECURITY] subject prefix — please include the module name, version and the steps to reproduce. We acknowledge promptly on business days and credit reporters in the Changelog if they wish. Wimakeit is a Belgian SRL (société à responsabilité limitée) bound by Belgian and EU privacy and disclosure law. About Wimakeit 1
Found something not covered by the FAQ?
Report a bug or ask a question — the form is prefilled with this module.
Changelog
Categories: Security, Feature, Fix, Perf, Admin, Deps.
[1.7.0] - 2026-05-28
Feature
- Interactive admin tour — first-time admins now see a floating "▶ Tour" button on the Login As Customer pages that walks them through finding a customer, the impersonation flow, the audit trail, and team-policy configuration in 5 steps. Completion is remembered locally; the button becomes "↻ Replay" afterwards. No new admin config needed.
Deps
- Bumped
wimakeit/module-corerequirement to^3.1.0(provides the tour runner).
[1.6.39] - 2026-05-22
Admin
- Per-element visibility toggles for the impersonation sticky bar — six new Yes/No fields under Stores → Configuration → Wimakeit → Login As Customer → General let admins independently hide or show the admin name, session timer, inactivity-timeout badge, max-session countdown, "Return to Admin" button, and "Disconnect" button. All default to enabled, so existing installs see no behavior change.
Perf
- Sticky bar is now single-line and ~32px tall on mobile (was stacking vertically and eating up to a quarter of the viewport on phones). On screens ≤768px the icon and timeout pill auto-hide and buttons collapse to icon-only (
titleattribute keeps a11y). On ≤480px the admin name hides too. Field sales reps on smartphones get their screen back.
[1.6.38] - 2026-05-13
Fix
- "Add to cart" no longer fails silently on the first click during an impersonation session — fixed a
TypeErroron numeric POST keys (options[123],super_attribute[456]) under PHP 8. - Page-visit logging is now best-effort: any unexpected error is logged and swallowed instead of bringing the storefront request down with it.
[1.6.37] - 2026-05-13
Fix
- Magento flash messages ("Product added to your cart", global notices, breadcrumbs) are now pushed below the impersonation bar instead of being hidden under it on themes that pin messages with
position: fixed.
[1.6.36] - 2026-05-13
Fix
- "Login Again" link from the admin dashboard widget and any custom admin grid button calling
wimakeit_lac/login/indexno longer returns 404. The admin URL secret-key segment remains the CSRF guard; the confirmation popup (POST + form_key) stays the preferred flow.
[1.6.35] - 2026-05-13
Feature
- Admin-configurable sticky-bar gradient — two new fields under Stores → Configuration → Customers → Login as Customer:
Bar color start(#ffa726) andBar color end(#f4511e). Scope-aware (default + website), validated as hex colors; set both to the same value for a solid background.
Admin
- Invalid color input falls back to the Wimakeit orange defaults so the bar can never be left unstyled.
[1.6.34] - 2026-05-13
Admin
- Impersonation sticky bar switches from blue/purple to Wimakeit amber → deep orange gradient. Distinct enough to telegraph "you are impersonating" without using alarming red. Button text recolored for legibility on the new background.
[1.6.33] - 2026-05-13
Feature
- New Disconnect button on the impersonation sticky bar — ends the session instantly via the standard customer logout flow without a round-trip through the admin tab.
Fix
- "Return to admin" link in the sticky bar now resolves the correct URL on stores that use a custom admin frontName (e.g. renamed
/admin/inenv.php). Previously produced a 404 on those installs.
Admin
- Removed orphan
token_ttladmin field that only configured the deleted token authentication subsystem.
[1.6.32] - 2026-05-13
Fix
- Open Source / Mage-OS admins are no longer blocked with "You are not authorized to access this customer". The per-website GWS scope check (added in 1.6.31) now only enforces when the role explicitly has GWS columns configured — pure Open Source installs skip the check entirely, Adobe Commerce installs with GWS continue to enforce it.
[1.6.31] - 2026-05-13
Security
- The
wimakeit_lac_activemarker cookie is now signed and verified on every read — a visitor can no longer set it manually to flip the storefront into impersonation layout (and burn site-wide Full Page Cache via the cacheable=false sticky-bar handle). - Marker-cookie lifetime dropped from 24 h to 1 h.
- Re-auth paths (cookie-driven and
AccountReauth) now enforce the Restricted Customer Groups setting, not just the initial takeover. - Raw session IDs and
REQUEST_URIare no longer written to logs (truncated SHA-256 used for correlation instead). wimakeit_lac_pendingcookie is now deleted after consumption on the cookie-auth path, matching the contract of the native reauthenticate plugin.- Per-website GWS scope is enforced on Adobe Commerce installs that have it configured.
- "Recent Logins" dashboard widget no longer renders
javascript:URLs — uses event delegation with a properly escaped data attribute. - Preview controller no longer masks unexpected exceptions as "no items"; returns an explicit failure.
Perf
- Triple re-auth stack collapsed into a single observer + plugin pair.
- Verbose info-level traces are now gated behind the debug toggle at the call site (no log writes when off, even before the line is built).
- "Is session ended?" check on every LAC page view replaced by a single-column SELECT instead of a full ORM hydration.
- Old-session cleanup is now a batched DELETE (
LIMIT 1000loop) — safe to lower retention without locking the table. - Cookie signing-key derivation is now cached.
- Front-end customer-data reload after takeover trimmed from 6 sections to 3 (
customer,cart,messages).
Fix
- Renamed an internal session key with a typo (
LoggedAsCustomerAdmindId→LoggedAsCustomerAdminId). Writers used the typo, readers used the un-typo'd name — fixing the asymmetry restores the sticky bar on edge cases. - Re-auth nested-enable guard no longer clobbers itself when a nested caller exits: every outer caller's guard is now respected.
Admin
- Dead "token authentication" subsystem removed (
wimakeit_lac_tokentable, related API interfaces, models, cron, plugins). The active path remains session-based. wimakeit_lac_log.customer_idis now nullable so the foreign key on customer deletion no longer leaves orphan rows visible.
[1.6.30] - 2026-05-13
Fix
- First takeover after the admin tab opens now correctly displays the customer name in the storefront header ("Hello, X") instead of staying in guest state. Post-auth redirect routes through the
Proceedpage so customer-data sections are invalidated and reloaded before navigating to the account dashboard.
[1.6.29] - 2026-05-12
Perf
- Admin quick-search widget no longer triggers Magento's "Fallback to JQueryUI Compat activated" warning — loads only the jQuery UI widget factory instead of the legacy monolithic bundle (~30 unused widgets dropped from the admin page).
[1.6.28] - 2026-05-12
Admin
- Admin dashboard widget code extracted to companion module
wimakeit/module-login-as-customer-admin-dashboard. The main module is now installable on stores that don't usewimakeit/module-admin-dashboard.
Deps
- To keep the "Recent Logins" widget on the admin dashboard, install
wimakeit/module-login-as-customer-admin-dashboardalongside this module.
[1.6.27] - 2026-05-11
Security
- Admins can no longer end another admin's active impersonation session by guessing the log ID — ownership is now verified.
- Cookie signing is now consistent across all login paths, preventing edge-case redirects to the login page.
Fix
- Customer logout during an admin impersonation now fully ends the session — no more silent re-login on the next request.
- "Login Again" button in the dashboard Recent Logins widget no longer returns a 404.
- Custom search page (
/wimakeit_lac/login/search/) now correctly shows the confirmation popup with cart preview and active-session warning. - Email notifications to customers now greet them by name instead of by email address.
Perf
- Quick-search results in the dashboard load up to 10× faster on stores with large order history.
[1.6.26] - 2026-05-10
Deps
- Requires
wimakeit/module-core3.0.9+ for the shared debug logger.
Admin
- Internal logging refactored to route through a single debug logger — cleaner code, no behavior change for merchants.
[1.6.25] - 2026-05-08
Feature
- New admin toggle Enable Debug Logging (Stores → Configuration → Wimakeit → Login As Customer → Logging Settings), off by default.
Perf
- Production sites stop emitting ~120,000 INFO log lines per day. Errors and warnings are still always logged.
Admin
- Flip the toggle on temporarily when you need to trace a specific re-authentication flow, then off again — no restart required.
[1.6.24] - 2026-05-08
Fix
- Fixed 404 page when confirming "Login As Customer" from the customer grid popup. The action now goes through the module's own controller, respecting ACL and session recording.
[1.6.23] - 2026-05-08
Perf
- Restored Varnish Full Page Cache for normal site traffic. The impersonation banner no longer forces a session start on every guest request.
Fix
- Fixed "Please refresh the page" alert when using the customer grid Login button on pages where the LAC popup component wasn't loaded.
Admin
- New
wimakeit_lac_activemarker cookie (HttpOnly, Secure, 24 h) used to detect impersonation without booting a customer session.
[1.6.10] - 2026-04-15
Fix
- Hardened CSS for the full-page search results to prevent third-party admin themes from breaking the layout.
[1.6.9] - 2026-04-15
Fix
- Customer search results no longer render at the bottom of the page on
/wimakeit_lac/login/search/. Dashboard quick-search styles were leaking into the full-page search.
[1.5.2] - 2026-03-16
Security
- Removed a public debug endpoint that could expose session data.
- Pre-login check now requires POST with CSRF protection (was GET).
- Secret key is now read from
app/etc/env.phpdeployment config instead of being hardcoded. - XSS hardening on customer name and orders columns in the log grid.
Perf
- Log grid "orders placed" column now loads in a single query instead of one per row.
- New composite database index for the active-session lookup.
[1.5.1] - 2026-03-16
Feature
- New Customer name column in the log grid, linking to the customer edit page.
- New Orders placed column in the log grid: count, total amount, and direct links to each order created during the impersonation.
[1.5.0] - 2026-03-16
Feature
- New Auto-logout after inactivity. Configurable timeout (default 15 minutes) and pre-logout warning countdown (default 60 seconds).
- Activity is detected on mouse, keyboard, scroll, and touch events. A "Stay Logged In" button resets the timer.
Admin
- Sticky impersonation banner now shows the configured timeout.
[1.4.0] - 2026-03-16
Feature
- Multi-admin awareness: if another admin is already logged in as the same customer, the popup shows their username and session start time before you proceed.
- Cart preview in the confirmation popup: see the customer's cart contents and total before logging in.
[1.3.1] - 2026-03-16
Feature
- LAC buttons are now color-coded: green when the customer has allowed remote assistance, red when they haven't.
Admin
- Dashboard "Recent logins" widget now shows the customer's name alongside their email.
- Quick search results include the same color-coded buttons.
[1.3.0] - 2026-03-16
Feature
- Page-visit recording now hooked into Magento's native Login As Customer flow.
Fix
- Dashboard and customer grid Login actions now go through Magento's native confirmation popup, fixing session-loss issues with direct-link logins.
- "Always Allow" mode now correctly bypasses Magento's customer-acceptance check via a dedicated plugin.
- Fixed a long-standing session-loss bug caused by duplicate session ID regeneration (Magento GitHub #15641).
[1.2.1] - 2026-03-12
Fix
- Fixed a race condition where the customer session was lost immediately after login. The post-login step now uses a JavaScript redirect to give the browser time to register the new session cookie.
[1.2.0] - 2026-03-11
Security
- Authentication error messages no longer expose internal exception details to the browser.
- Sensitive query parameters are now redacted from logged URLs.
Perf
- Page-visit counter now uses a single atomic SQL UPDATE.
- Four new composite indexes on the log table for faster grid filtering.
- Customer grid summary column now loads in 2–3 queries instead of one per customer.
- Token cleanup cron reduced from hourly to every 4 hours (tokens expire much faster than that anyway).
[1.1.0] - 2026-03-11
Feature
- New Quick Customer Search dashboard widget — search by name or email and log in with one click.
- New Customer Acceptance Mode with three options: Always Allow, Ask Customer, Always Deny.
Security
- CSRF protection added to the search widget login forms.
Fix
- Fixed a dependency injection error that prevented the module from booting on some installs.
[1.0.0] - 2026-03-01
Feature
- Initial release.
- Secure one-click login as customer from customer grid, order grid, and customer edit page.
- Short-lived authentication tokens with automatic expiration.
- Multi-store support with automatic or manual store selection.
- Guest order conversion to customer account.
Security
- Granular ACL: separate permissions for login, log viewing, guest conversion, and configuration.
- Full audit log: every session logged with admin, customer, duration, pages visited.
- Optional session recording (page-by-page activity tracking).
- Optional mandatory admin notes for compliance.
- Restricted customer groups (block impersonation for VIP / staff groups).
Admin
- Sticky frontend banner so the admin always knows they're impersonating.
- Hourly token cleanup and daily log cleanup with configurable retention.
Found a bug? Tell us about it.
A short form opens in a new tab — the module name and your language are already filled in. Share what you tried, what went wrong, and we will get back to you within one business day.
Report a bug for Login as Customer ProNeed help?
Our team is available to assist with integration.