Skip to main content
View as Markdown

Security Practices - Authentication

Common Security Practices​

  • Least privilege: Prefer USER KS; scope permissions to what the call needs.
  • Short TTLs: Set per the expected user interaction duration, balancing security with renewal frequency.
  • Backend only: Keep admin secrets and app token secrets on the server side.
  • Entitlements over broad privileges: Enforce access via Access Control/Entitlements and privacy context strings in KS. Use specific privileges; use * only for controlled internal ADMIN sessions.
  • Rotate Application Tokens and Sessions regularly. Revoke as needed using session.end.
  • API secrets are permanent. The adminSecret and secret for a Kaltura account cannot be regenerated, rotated, or revoked. If a secret is compromised, contact Kaltura support. Use Application Tokens (AppTokens) for all integrations — AppTokens can be revoked and reissued independently, giving you full credential lifecycle control. See AppTokens Guide.