---
title: Overview
url: https://docs.kaltura.com/docs/getting-started/authentication/ks-overview
---

## Kaltura Session (KS) Generation and Management

Generate, use, and rotate Kaltura Sessions (KS) — the signed, time-limited tokens that authenticate every Kaltura API call and player embed.

**Base URL:** `https://www.kaltura.com/api_v3` (may differ by region/deployment)  
**Auth:** KS passed as `ks` parameter in POST form data, or as embed URL parameter  
**Format:** Form-encoded POST, `format=1` for JSON responses  


## When to Use

- **Every Kaltura API integration starts here** -- a valid Kaltura Session (KS) is required for every API call and player embed across the platform.  
- **Backend automation systems** generate server-side sessions with appropriate type, expiry, and privileges to control what each integration can access.  
- **Client-facing applications** use AppToken-based session exchange to obtain scoped KS tokens without exposing admin secrets to end users.  
- **Security and compliance teams** define session privilege policies that enforce content isolation, user tracking, and access boundaries.

## Prerequisites

- **Partner ID and Admin Secret:** Available from KMC under Settings > Integration Settings. See [Getting Credentials](/docs/getting-started/general/credentials-overview) for step-by-step setup.  
- **Admin secret (for `session.start`):** Required for server-side KS generation. Keep strictly server-side; use AppTokens for client-facing integrations.  
- **Service URL:** Set `$KALTURA_SERVICE_URL` to your account's regional endpoint (default: `https://www.kaltura.com/api_v3`).  
- **Understanding of session types:** USER (type=0) for end-user contexts, ADMIN (type=2) for backend administration. This guide covers both.