---
title: Login & Credentials
url: https://docs.kaltura.com/docs/rich-media-cms-apis/content-management/user-management-login-credentials
---

## Login & Credentials


### Enable Login

Grant a user the ability to log in with email + password:


```bash
curl -X POST "$KALTURA_SERVICE_URL/service/user/action/enableLogin" \
  -d "ks=$KALTURA_KS" \
  -d "format=1" \
  -d "userId=jane.doe@example.com" \
  -d "loginId=jane.doe@example.com" \
  -d "password=SecureP@ssw0rd123"
```


| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `userId` | string | Yes | User to enable login for |
| `loginId` | string | Yes | Login identifier (typically the email) |
| `password` | string | No | Initial password (auto-generated if omitted) |

After enabling login, the user's `loginEnabled` field becomes `true`.

### Disable Login


```bash
curl -X POST "$KALTURA_SERVICE_URL/service/user/action/disableLogin" \
  -d "ks=$KALTURA_KS" \
  -d "format=1" \
  -d "userId=jane.doe@example.com"
```


Removes the user's ability to log in with credentials. SSO login via Auth Broker is not affected by this setting.

### Login by Credentials


```bash
curl -X POST "$KALTURA_SERVICE_URL/service/user/action/loginByLoginId" \
  -d "format=1" \
  -d "loginId=jane.doe@example.com" \
  -d "password=SecureP@ssw0rd123" \
  -d "partnerId=$KALTURA_PARTNER_ID"
```


| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `loginId` | string | Yes | Login identifier (typically email) |
| `password` | string | Yes | User password |
| `partnerId` | integer | Yes | Partner ID to log in to |
| `expiry` | integer | No | KS expiry in seconds (default: 86400) |
| `privileges` | string | No | Comma-separated KS privileges |
| `otp` | string | No | One-time password for accounts with 2FA enabled |

Returns a KS string on success. This action does not require an existing KS.

**Password complexity requirements:** Passwords must meet the account's configured policy. The default requires at least 8 characters, including uppercase, lowercase, digits, and special characters. If the password is invalid, the API returns `PASSWORD_STRUCTURE_INVALID`.

### Reset Password


```bash
curl -X POST "$KALTURA_SERVICE_URL/service/user/action/resetPassword" \
  -d "format=1" \
  -d "email=jane.doe@example.com"
```


| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `email` | string | Yes | Email address of the user whose password should be reset |

Sends a password reset email. Does not require a KS. The email contains a hash key used with `setInitialPassword` (section 7.5).

### Set Initial Password


```bash
curl -X POST "$KALTURA_SERVICE_URL/service/user/action/setInitialPassword" \
  -d "format=1" \
  -d "hashKey=$HASH_KEY" \
  -d "newPassword=NewSecureP@ss456"
```


| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `hashKey` | string | Yes | Hash key from the password reset or invitation email |
| `newPassword` | string | Yes | New password (must meet account password complexity requirements) |

Sets a password using a hash key received via email (from `resetPassword` or invitation). Does not require a KS. The new password must meet the account's configured complexity policy (see section 7.3 for password requirements).