Skip to main content
View as Markdown

Overview - Authentication

Kaltura Session (KS) Generation and Management​

Generate, use, and rotate Kaltura Sessions (KS) — the signed, time-limited tokens that authenticate every Kaltura API call and player embed.

Base URL: https://www.kaltura.com/api_v3 (may differ by region/deployment)
Auth: KS passed as ks parameter in POST form data, or as embed URL parameter
Format: Form-encoded POST, format=1 for JSON responses

When to Use​

  • Every Kaltura API integration starts here -- a valid Kaltura Session (KS) is required for every API call and player embed across the platform.
  • Backend automation systems generate server-side sessions with appropriate type, expiry, and privileges to control what each integration can access.
  • Client-facing applications use AppToken-based session exchange to obtain scoped KS tokens without exposing admin secrets to end users.
  • Security and compliance teams define session privilege policies that enforce content isolation, user tracking, and access boundaries.

Prerequisites​

  • Partner ID and Admin Secret: Available from KMC under Settings > Integration Settings. See Getting Credentials for step-by-step setup.
  • Admin secret (for session.start): Required for server-side KS generation. Keep strictly server-side; use AppTokens for client-facing integrations.
  • Service URL: Set $KALTURA_SERVICE_URL to your account's regional endpoint (default: https://www.kaltura.com/api_v3).
  • Understanding of session types: USER (type=0) for end-user contexts, ADMIN (type=2) for backend administration. This guide covers both.