Create and redeem a Clerk sign-in token or actor token for programmatic sign-in and user impersonation

Documented steps

1. Sign-in token: POST https://api.clerk.com/v1/sign_in_tokens with 'Authorization: Bearer <CLERK_SECRET_KEY>', 'Content-Type: application/json' and body {"user_id": "user_xxx", "expires_in_seconds": 3600}.
2. expires_in_seconds is optional. Clerk documents the default as 2592000 seconds (30 days), so set it explicitly for anything short-lived.
3. SDK equivalent: clerkClient.signInTokens.createSignInToken({ userId, expiresInSeconds }).
4. Actor (impersonation) token: POST https://api.clerk.com/v1/actor_tokens with body {"user_id": "<user to impersonate>", "actor": {"sub": "<impersonating admin's user id>"}, "expires_in_seconds": 600}.
5. The actor_tokens response includes a url. Navigating there signs out the current browser user and redirects to your sign-in route with a __clerk_ticket query param.
6. Redeem client-side with the ticket strategy: signIn.create({ strategy: 'ticket', ticket }) then setActive / signIn.finalize() to establish the session.
7. Both token types are single use. A consumed or expired ticket cannot be replayed.
8. An impersonation session's JWT carries an act claim identifying the impersonated session and the acting user id; log it for audit.
9. Only ever mint these from trusted server code holding the secret key. Never expose the endpoint or the raw token to end users.