Case Study: Podia protects impersonation workflows with WorkOS

Podia reduces impersonation risk in 60-minute sessions with WorkOS

Podia, an online platform for creators, faced significant challenges when implementing user impersonation for customer support. While their identity provider, WorkOS, provided the technical ability to impersonate users easily, the session-based nature of impersonation caused widespread unintended side effects. These included sending false notifications and emails to users, corrupting analytics and usage data, enrolling users in feature flag experiments, and triggering background jobs that ran under the wrong user identity long after the support session had ended.

WorkOS provided the foundational solution by embedding impersonation context directly into the access token and session response, available at the very start of the session. This gave Podia a clear flag to identify support sessions before any downstream systems initialized. By leveraging this flag, Podia was able to systematically guard against the side effects across their entire stack, including analytics, lifecycle emails, webhooks, and background jobs. The result was a secure and transparent impersonation feature that protected customer data integrity, prevented false notifications, and provided a clear audit trail for both Podia and their users.

Podia