---
title: Why AppTokens
url: https://docs.kaltura.com/docs/getting-started/authentication/app-tokens-why
---

## Why AppTokens Instead of Admin Secrets

| Concern | Admin Secret | AppToken |
|---------|-------------|----------|
| Revocation | Rotating the secret requires updating ALL integrations simultaneously | Delete one token → only that integration loses access |
| Privilege scope | Full admin unless you manually restrict each KS | Baked into the token at creation time |
| Secret exposure | Grants full account access to any holder | Grants only scoped access, easily revocable |
| Rotation | Requires coordinated update across every integration | Create new token, distribute, delete old one |
| Audit | All integrations share one identity in logs | Each token has a unique ID in logs |

**Rule of thumb:** Use `session.start` only for internal backend tools where you control the environment. Use AppTokens for everything else — partner integrations, microservices, client apps.

> **API secrets are permanent.** The `adminSecret` and `secret` for a Kaltura account are fixed for the lifetime of the account. If a secret is compromised, contact Kaltura support. This makes AppTokens essential — they can be revoked and reissued independently without affecting other integrations.