Skip to main content
View as Markdown

Best Practices - Authentication

Best Practices​

  • Use SHA256 or SHA512 for all new tokens. MD5 and SHA1 are supported for backward compatibility only.
  • Set sessionExpiry on AppTokens to limit session duration (e.g., 86400 for 24 hours). Shorter is more secure.
  • Scope privileges tightly. Use sessionPrivileges to restrict what the generated KS can do: edit:entryId, sview:*, setrole:ROLE_ID, iprestrict:CIDR.
  • Rotate tokens periodically. Create a new token, migrate integrations, then delete the old one. See Token Rotation Pattern.
  • Store tokens server-side only. Keep AppToken IDs and token values on your backend. The HMAC exchange should happen on your server.
  • One token per integration. Create separate AppTokens for each application or service to isolate access and simplify revocation.
  • Session Guide — KS generation, privileges, and session management
  • Upload & Ingestion — Use AppToken-generated KS for uploads
  • Player Embed — Generate scoped player KS via AppToken flow
  • Webhooks — AppToken-based KS for webhook handler authentication
  • Analytics Reports — Analytics-scoped tokens for reporting dashboards
  • Distribution — Scoped tokens for distribution automation
  • API Overview — Foundation guide covering API structure and authentication