---
title: Best Practices
url: https://docs.kaltura.com/docs/getting-started/general/credentials-best-practices
---

## Best Practices

Prefer AppTokens for production applications. AppTokens provide better scoping, are revocable per-app, and eliminate the need to distribute the Admin Secret to multiple services. See **[AppTokens](/docs/getting-started/authentication/app-tokens-overview)** for implementation details.

Keep the Admin Secret exclusively on the server side. Treat it as a master key — it cannot be rotated or regenerated. Any service or person with the Admin Secret has full account access.

Store credentials in `.env` files and add `.env` to `.gitignore`. Use environment variables in all API calls rather than hardcoding values.

Use short-lived KS tokens (1-4 hours). Generate sessions on demand rather than storing long-lived tokens. AppTokens handle session renewal gracefully.

KS type determines privileges from the same Admin Secret:
- `type=2` (ADMIN) — full account management, user impersonation, content across all users
- `type=0` (USER) — scoped to the specified userId, suitable for client-side playback and user-specific operations


## Related Guides

- **[API Overview](/docs/getting-started/general/api-overview)** — API request structure, endpoints, multirequest batching, error handling
- **[Session Guide](/docs/getting-started/authentication/ks-overview)** — KS types, creation methods, privileges, validation, security
- **[AppTokens](/docs/getting-started/authentication/app-tokens-overview)** — Production auth without exposing secrets, HMAC-based session start, scoped per-app tokens