Why AppTokens - Authentication
Why AppTokens Instead of Admin Secrets
| Concern | Admin Secret | AppToken |
|---|---|---|
| Revocation | Rotating the secret requires updating ALL integrations simultaneously | Delete one token → only that integration loses access |
| Privilege scope | Full admin unless you manually restrict each KS | Baked into the token at creation time |
| Secret exposure | Grants full account access to any holder | Grants only scoped access, easily revocable |
| Rotation | Requires coordinated update across every integration | Create new token, distribute, delete old one |
| Audit | All integrations share one identity in logs | Each token has a unique ID in logs |
Rule of thumb: Use session.start only for internal backend tools where you control the environment. Use AppTokens for everything else — partner integrations, microservices, client apps.
API secrets are permanent. The
adminSecretandsecretfor a Kaltura account are fixed for the lifetime of the account. If a secret is compromised, contact Kaltura support. This makes AppTokens essential — they can be revoked and reissued independently without affecting other integrations.