Skip to main content
View as Markdown

Best Practices - Getting Started

Best Practices​

Prefer AppTokens for production applications. AppTokens provide better scoping, are revocable per-app, and eliminate the need to distribute the Admin Secret to multiple services. See AppTokens for implementation details.

Keep the Admin Secret exclusively on the server side. Treat it as a master key — it cannot be rotated or regenerated. Any service or person with the Admin Secret has full account access.

Store credentials in .env files and add .env to .gitignore. Use environment variables in all API calls rather than hardcoding values.

Use short-lived KS tokens (1-4 hours). Generate sessions on demand rather than storing long-lived tokens. AppTokens handle session renewal gracefully.

KS type determines privileges from the same Admin Secret:

  • type=2 (ADMIN) — full account management, user impersonation, content across all users
  • type=0 (USER) — scoped to the specified userId, suitable for client-side playback and user-specific operations
  • API Overview — API request structure, endpoints, multirequest batching, error handling
  • Session Guide — KS types, creation methods, privileges, validation, security
  • AppTokens — Production auth without exposing secrets, HMAC-based session start, scoped per-app tokens