What is DRM: Widevine & FairPlay Protection?

Widevine (Google) and FairPlay (Apple) are DRM systems that encrypt media with CENC keys and release them only to trusted decoders. Mainstream OTT services use them; IPTV panels typically use HLS AES-128 segment encryption or TLS instead of full DRM.

Generally no; IPTV content is delivered unencrypted or with AES-128 keys fetched over the Xtream session.

Standard HLS with 4-second segments and a 3-segment player window sits 12-18 seconds behind the broadcast. Low-Latency HLS with 0.5-second partial segments brings glass-to-glass delay to about 3.8 seconds, and raw MPEG-TS over HTTP (.ts output format) is typically 5-7 seconds behind. Choose the .ts output format in your player for live sports and reserve .m3u8 for VOD and catch-up.

Set the largest option (5,000 ms in TiviMate, "Large" in Smarters). Buffer time in seconds equals buffer bytes multiplied by 8, divided by the stream bitrate in Mbps: a 15 MB allocation on an 18.5 Mbps 4K feed yields 6.5 seconds of protection, which covers typical ISP shaping bursts of 2-4 seconds without a visible freeze.

All three deliver the same channels. Xtream Codes API uses player_api.php JSON endpoints so the player lazy-loads categories and EPG in seconds. An M3U URL (get.php) downloads a single text playlist of every stream, which is slow with 45,000 channels but works on any player. Stalker Portal authenticates by MAC address through a /c/ portal URL and is used by MAG receivers and some Smart TV apps.

Players fetch an XMLTV file from xmltv.php and match each channel by tvg-id. An empty guide means the player downloaded the file before the server finished its 15-minute refresh or the file exceeded the player size cap (set TiviMate EPG update to "never limit"). Wrong times are a timezone offset issue: XMLTV timestamps carry +0000 and the player must apply your local offset, so set an EPG shift of +1 or -5 hours in the channel settings rather than changing the device clock.

The Xtream Codes player_api.php handshake returns max_connections and active_cons. Each live or VOD stream request opens one session counted against that limit; a second TV, phone, or multi-view tile is a second connection. When active_cons would exceed max_connections, the server answers the new stream request with HTTP 403 / 458 and the player shows "max connections reached". Resellers should sell lines with 2-5 connections for households and enable IP-lock only for single-device subscribers.