---
title: Best Practices
url: https://docs.kaltura.com/docs/getting-started/authentication/app-tokens-best-practices
---

## Best Practices

- **Use SHA256 or SHA512** for all new tokens. MD5 and SHA1 are supported for backward compatibility only.
- **Set `sessionExpiry`** on AppTokens to limit session duration (e.g., 86400 for 24 hours). Shorter is more secure.
- **Scope privileges tightly.** Use `sessionPrivileges` to restrict what the generated KS can do: `edit:entryId`, `sview:*`, `setrole:ROLE_ID`, `iprestrict:CIDR`.
- **Rotate tokens periodically.** Create a new token, migrate integrations, then delete the old one. See [Token Rotation Pattern](/docs/getting-started/authentication/app-tokens-rotation).
- **Store tokens server-side only.** Keep AppToken IDs and token values on your backend. The HMAC exchange should happen on your server.
- **One token per integration.** Create separate AppTokens for each application or service to isolate access and simplify revocation.

## Related Guides

- **[Session Guide](/docs/getting-started/authentication/ks-overview)** — KS generation, privileges, and session management
- **[Upload & Ingestion](/docs/rich-media-cms-apis/content-management/upload-ingestion-overview)** — Use AppToken-generated KS for uploads
- **[Player Embed](/docs/embeddable-kaltura-products/kaltura-player/player-embed-overview)** — Generate scoped player KS via AppToken flow
- **[Webhooks](/docs/rich-media-cms-apis/integration/webhooks)** — AppToken-based KS for webhook handler authentication
- **[Analytics Reports](/docs/rich-media-cms-apis/analytics/analytics-overview)** — Analytics-scoped tokens for reporting dashboards
- **[Distribution](/docs/rich-media-cms-apis/integration/distribution)** — Scoped tokens for distribution automation
- **[API Overview](/docs/getting-started/general/api-overview)** — Foundation guide covering API structure and authentication