The access to service [media->list] is forbidden

Hello,

I'm not sure what the issue is in your case but in the code above, it is that setKs() is never called.
Should be something like:
var config = new KalturaConfiguration(partner_id);
config.serviceUrl = "https://www.kaltura.com/";
var client = new KalturaClient(config);
client.session.start(function(success, ks) {
if (!success || (ks.code && ks.message)) {
console.log('Error starting session', success, ks);
console.log(ks.message || 'Unknown Error')
} else {
client.setKs(ks);
}

}, "secrethash",
"userid@kaltura.com",
KalturaSessionType.ADMIN,
partner_id)

Also take a look at developer.kaltura.com which is a good way to get started with the API.