---
title: Overview
url: https://docs.kaltura.com/docs/getting-started/authentication/app-tokens-overview
---

## Kaltura Application Tokens (AppTokens) API

Application Tokens provide secure, scoped API access without exposing admin secrets. Instead of sharing your `adminSecret`, you create an AppToken with specific privileges, distribute it to integrators, and they use an HMAC exchange to obtain a KS. You can revoke access instantly by deleting the token.

**Base URL:** `https://www.kaltura.com/api_v3`  
**Auth:** Admin KS for token management; widget session + HMAC for `startSession`  
**Format:** Form-encoded POST, `format=1` for JSON responses  


## When to Use

- **Production integrations** require revocable, scoped API credentials that can be rotated without disrupting other services or exposing admin secrets.  
- **Server-to-server microservices** authenticate with Kaltura using HMAC-based token exchange, keeping secrets strictly on the backend.  
- **Mobile and client-side applications** need API access without embedding permanent credentials in compiled binaries or client-side code.  
- **Partner and vendor onboarding** provisions isolated API access with specific privilege sets that can be revoked independently per integration.

## Prerequisites

- **Kaltura Session (KS):** ADMIN KS (type=2) required for creating, listing, and managing AppTokens. See [Session Guide](/docs/getting-started/authentication/ks-overview) for generation methods.  
- **Partner ID and Admin Secret:** Needed for the initial ADMIN KS that creates the AppToken. See [Getting Credentials](/docs/getting-started/general/credentials-overview) for step-by-step setup.  
- **Service URL:** Set `$KALTURA_SERVICE_URL` to your account's regional endpoint (default: `https://www.kaltura.com/api_v3`).  
- **Hash algorithm choice:** Select a hash type (SHA256 recommended) at token creation time -- it is immutable after creation.