Is there a reason the admin API does not have an endpoint to allow us to create sessions on behalf of users? I can imagine that would make Kratos really extensible and allow users to implement custom auth flows like SMS based passwordless login, and not have to wait for official support.

Because then people most likely get something wrong about that, potentially breaching their system. At Ory we want security best-practices to be easily accessible, and therefore don't want features that make it easy to circumnavigate security.

Thanks!