---
title: Server-Side KS
url: https://docs.kaltura.com/docs/embeddable-kaltura-products/kaltura-player/player-embed-server-ks
---

## Server-Side KS for Player

Generate a scoped USER KS (type=0) for player embeds. Use specific privileges to control what the player can access:

```bash
curl -X POST "$KALTURA_SERVICE_URL/service/session/action/start" \
  -d "format=1" \
  -d "partnerId=$KALTURA_PARTNER_ID" \
  -d "secret=$KALTURA_ADMIN_SECRET" \
  -d "type=0" \
  -d "userId=viewer@example.com" \
  -d "expiry=3600" \
  -d "privileges=sview:ENTRY_ID,appid:myapp-example.com,privacycontext:MY_PORTAL"
```

**Recommended player KS privileges:**

| Privilege | Purpose |
|-----------|---------|
| `sview:ENTRY_ID` | Restrict playback to a specific entry (or `sview:*` for all accessible entries) |
| `appid:APP_NAME-APP_DOMAIN` | Analytics tracking — identifies which app/domain generated the playback |
| `privacycontext:CATEGORY_NAME` | Scope access to entries in a specific privacy-enabled category |
| `setrole:PLAYBACK_BASE_ROLE` | Restrict the KS to read-only playback operations |
| `enableentitlement` | Enforce category entitlement checks |

### IP Tokenization for CDN-Protected Content

When CDN tokenization is enforced on your account, the player KS must include the viewer's IP address so the CDN can validate the request:

1. **Server looks up the viewer's IP** from the HTTP request
2. **Generates a KS with `iprestrict:IP`** to bind the session to that IP
3. **Configures the player** to use HLS-only streaming (required for IP-tokenized delivery)

```javascript
const player = KalturaPlayer.setup({
  targetId: 'kplayer',
  provider: {
    partnerId: PARTNER_ID,
    uiConfId: UICONF_ID,
    ks: IP_RESTRICTED_KS  // KS includes iprestrict:VIEWER_IP
  },
  playback: {
    autoplay: true,
    streamPriority: [
      { engine: 'html5', format: 'hls' }  // Force HLS for CDN tokenization
    ]
  }
});
```

> IP tokenization requires account-level CDN configuration. Contact your Kaltura specialist for setup. See [Session Guide](/docs/getting-started/authentication/ks-overview) for `iprestrict` privilege details.