Server-Side KS - Kaltura Player

Server-Side KS for Player

Generate a scoped USER KS (type=0) for player embeds. Use specific privileges to control what the player can access:

curl -X POST "$KALTURA_SERVICE_URL/service/session/action/start" \
  -d "format=1" \
  -d "partnerId=$KALTURA_PARTNER_ID" \
  -d "secret=$KALTURA_ADMIN_SECRET" \
  -d "type=0" \
  -d "userId=viewer@example.com" \
  -d "expiry=3600" \
  -d "privileges=sview:ENTRY_ID,appid:myapp-example.com,privacycontext:MY_PORTAL"

Recommended player KS privileges:

Privilege	Purpose
sview:ENTRY_ID	Restrict playback to a specific entry (or sview:* for all accessible entries)
appid:APP_NAME-APP_DOMAIN	Analytics tracking — identifies which app/domain generated the playback
privacycontext:CATEGORY_NAME	Scope access to entries in a specific privacy-enabled category
setrole:PLAYBACK_BASE_ROLE	Restrict the KS to read-only playback operations
enableentitlement	Enforce category entitlement checks

IP Tokenization for CDN-Protected Content

When CDN tokenization is enforced on your account, the player KS must include the viewer's IP address so the CDN can validate the request:

1. Server looks up the viewer's IP from the HTTP request
2. Generates a KS with iprestrict:IP to bind the session to that IP
3. Configures the player to use HLS-only streaming (required for IP-tokenized delivery)

const player = KalturaPlayer.setup({
  targetId: 'kplayer',
  provider: {
    partnerId: PARTNER_ID,
    uiConfId: UICONF_ID,
    ks: IP_RESTRICTED_KS  // KS includes iprestrict:VIEWER_IP
  },
  playback: {
    autoplay: true,
    streamPriority: [
      { engine: 'html5', format: 'hls' }  // Force HLS for CDN tokenization
    ]
  }
});

IP tokenization requires account-level CDN configuration. Contact your Kaltura specialist for setup. See Session Guide for iprestrict privilege details.