---
title: Best Practices
url: https://docs.kaltura.com/docs/getting-started/general/api-best-practices
---

## Best Practices

- **Use AppTokens in production.** The `session.start` examples in this guide are for getting started. In production, use [AppTokens](/docs/getting-started/authentication/app-tokens-overview) to avoid exposing your admin secret.  
- **Always include `format=1`.** Without it, API v3 returns XML instead of JSON.  
- **Set `$KALTURA_SERVICE_URL` to your region.** All examples use this variable. Set it to your account's regional endpoint (see [Endpoints & Regions](/docs/getting-started/general/api-endpoints-regions)).  
- **Check multirequest sub-results individually.** Each element in the response array can be a success or a `KalturaAPIException` — check each one.  
- **Use short-lived KS tokens.** Default to 1-4 hour expiry. Renew via AppToken flow rather than generating long-lived admin sessions.

## Related Guides

- **[Session Guide](/docs/getting-started/authentication/ks-overview)** — Deep dive into KS types, creation methods, privileges, and security
- **[AppTokens](/docs/getting-started/authentication/app-tokens-overview)** — Production authentication without exposing secrets
- **[Upload & Ingestion](/docs/rich-media-cms-apis/content-management/upload-ingestion-overview)** — Upload content, manage flavors and attachments
- **[Player Embed](/docs/embeddable-kaltura-products/kaltura-player/player-embed-overview)** — Embed the video player in web applications