Token Rotation - Authentication

Token Rotation Pattern

Rotating AppTokens without downtime:

1. Create new token — appToken.add with same privileges
2. Distribute — update your integration to use the new token ID + value
3. Verify — confirm the integration works with the new token
4. Delete old token — appToken.delete on the previous token

# Step 1: Create new token
curl -X POST "$KALTURA_SERVICE_URL/service/appToken/action/add" \
  -d "ks=$KALTURA_KS" \
  -d "format=1" \
  -d "appToken[objectType]=KalturaAppToken" \
  -d "appToken[hashType]=SHA256" \
  -d "appToken[sessionType]=0" \
  -d "appToken[sessionPrivileges]=sview:*,list:*" \
  -d "appToken[description]=Rotated token - 2024-Q4"

# Step 3 (after deploying new token to integrations):
# Delete old token
curl -X POST "$KALTURA_SERVICE_URL/service/appToken/action/delete" \
  -d "ks=$KALTURA_KS" \
  -d "format=1" \
  -d "id=$OLD_TOKEN_ID"