---
title: Auth & Headers
url: https://docs.kaltura.com/docs/conversational-agents/avatar-videos/auth
---

## Auth & Headers

All server-side API endpoints require a valid Kaltura Session (KS). A user-level KS (type=0) is sufficient — no admin privileges are required. The service authenticates the KS and extracts the `partnerId` and `userId` to scope all data: each user only sees and manages their own videos and avatars.

```bash
# Generate a KS (type=0 user session is sufficient)
KS=$(curl -s -X POST "$KALTURA_SERVICE_URL/service/session/action/start" \
  -d "format=1" \
  -d "secret=$KALTURA_ADMIN_SECRET" \
  -d "partnerId=$KALTURA_PARTNER_ID" \
  -d "type=0" \
  -d "userId=creator@example.com" \
  -d "expiry=86400" | tr -d '"')

# All API calls use Bearer auth with JSON body
AVATAR_API="https://video-avatar.nvp1.ovp.kaltura.com/api/v1"
```

Every request uses:
- **Method:** POST  
- **Header:** `Authorization: Bearer $KS`  
- **Header:** `Content-Type: application/json`  
- **Body:** JSON  

**KS requirements:**
- A plain KS works — standard privileges are sufficient (no `disableentitlement` or custom privileges required)  
- Both `type=0` (USER) and `type=2` (ADMIN) sessions work  
- Data isolation is per-user: each user sees only their own videos and avatars, regardless of session type  
- The partner account must have the VOD Avatar feature enabled. Use `partner/checkConfiguration` to verify:
  ```bash
  curl -s -X POST "$AVATAR_API/partner/checkConfiguration" \
    -H "Authorization: Bearer $KS" \
    -H "Content-Type: application/json" \
    -d '{}'
  ```
  The response lists prerequisite checks with `valid: true/false`. The `source-only-conversion-profile` check must be valid. Contact your Kaltura account manager if checks fail  
- If the KS contains a `urirestrict` privilege, the restricted URI pattern must match the API path