---
title: Error Handling
url: https://docs.kaltura.com/docs/getting-started/authentication/ks-error-handling
---

## Error Handling

* Common KS-related error codes: `INVALID_KS` (malformed, expired, or revoked), `MISSING_KS` (no KS provided), `SERVICE_FORBIDDEN` (KS lacks permission), `EXPIRED_KS` (session past TTL), `ACTION_BLOCKED` (action limit reached).
* On invalid/expired KS or insufficient privileges: re-issue with correct scope.
* On 5xx / transient: use exponential backoff (e.g., 500ms, 1s, 2s, jitter), and cap retries. Monitor your request rate to stay within throttling limits.
* Observability: log who asked for a session, requested TTL & privileges, and the call outcome (success/failure). Mask KS values in logs (show only last 6 chars) and store secrets exclusively in secret managers.

**Retry strategy:** For transient errors (HTTP 5xx, timeouts), retry with exponential backoff: 1s, 2s, 4s, with jitter, up to 3 retries. For client errors (4xx, `INVALID_KS`, insufficient privileges), fix the request parameters or re-issue the KS before retrying — these require corrective action to succeed.