---
title: Security Practices
url: https://docs.kaltura.com/docs/getting-started/authentication/ks-security
---

## Common Security Practices

*	Least privilege: Prefer USER KS; scope permissions to what the call needs.
*	Short TTLs: Set per the expected user interaction duration, balancing security with renewal frequency.
*	Backend only: Keep admin secrets and app token secrets on the server side.
*	Entitlements over broad privileges: Enforce access via Access Control/Entitlements and privacy context strings in KS. Use specific privileges; use `*` only for controlled internal ADMIN sessions.
* Rotate Application Tokens and Sessions regularly. Revoke as needed using `session.end`.
* **API secrets are permanent.** The `adminSecret` and `secret` for a Kaltura account cannot be regenerated, rotated, or revoked. If a secret is compromised, contact Kaltura support. Use Application Tokens (AppTokens) for all integrations — AppTokens can be revoked and reissued independently, giving you full credential lifecycle control. See [AppTokens Guide](/docs/getting-started/authentication/app-tokens-overview).