Skip to main content
View as Markdown

Overview - Authentication

Kaltura Application Tokens (AppTokens) API​

Application Tokens provide secure, scoped API access without exposing admin secrets. Instead of sharing your adminSecret, you create an AppToken with specific privileges, distribute it to integrators, and they use an HMAC exchange to obtain a KS. You can revoke access instantly by deleting the token.

Base URL: https://www.kaltura.com/api_v3
Auth: Admin KS for token management; widget session + HMAC for startSession
Format: Form-encoded POST, format=1 for JSON responses

When to Use​

  • Production integrations require revocable, scoped API credentials that can be rotated without disrupting other services or exposing admin secrets.
  • Server-to-server microservices authenticate with Kaltura using HMAC-based token exchange, keeping secrets strictly on the backend.
  • Mobile and client-side applications need API access without embedding permanent credentials in compiled binaries or client-side code.
  • Partner and vendor onboarding provisions isolated API access with specific privilege sets that can be revoked independently per integration.

Prerequisites​

  • Kaltura Session (KS): ADMIN KS (type=2) required for creating, listing, and managing AppTokens. See Session Guide for generation methods.
  • Partner ID and Admin Secret: Needed for the initial ADMIN KS that creates the AppToken. See Getting Credentials for step-by-step setup.
  • Service URL: Set $KALTURA_SERVICE_URL to your account's regional endpoint (default: https://www.kaltura.com/api_v3).
  • Hash algorithm choice: Select a hash type (SHA256 recommended) at token creation time -- it is immutable after creation.