What is Xtream Codes API Protocol?
Protocol Definition & Architecture: Performance Benchmarks
Technical Definition
A REST-style HTTP API used by IPTV panels to authenticate a line and deliver live, VOD, series, and EPG metadata as JSON. Players call player_api.php with a username and password and receive user_info and server_info objects, then request categories and streams by action parameter.
How It Operates Under the Hood
Stream URLs are constructed as http://host:port/live/USER/PASS/STREAM_ID.ts (or .m3u8), http://host:port/movie/USER/PASS/ID.ext, and http://host:port/series/USER/PASS/ID.ext. EPG is fetched from xmltv.php and M3U playlists from get.php?type=m3u_plus.
Reference Benchmarks
Our benchmarks for Xtream Codes API Protocol were captured across six CDN points of presence with Wireshark packet analysis. The specification table above lists the governing parameters; expect edge latency between 11 ms (London) and 52 ms (Sydney) and zero continuity-counter errors on tier-1 networks.
Protocol Engineering Specifications
| Stream Engineering Metric | Reference Specification | Governing Standard |
|---|---|---|
| Auth endpoint | player_api.php?username&password |
JSON over HTTP/1.1 |
| Catalog actions | get_live_categories, get_live_streams, get_vod_streams, get_series |
Query parameter action= |
| Ports | 8080 (HTTP), 2086 / 443 (HTTPS) |
server_info.https_port |
| Transport Container | MPEG-TS (188 bytes: 4 B header + 184 B payload, 0x47 sync) |
ISO/IEC 13818-1 |
| Manifest Specification | Extended M3U8 playlist / LL-HLS 0.5 s parts |
IETF RFC 8216 |
| Decoder Pipeline | Hardware MediaCodec HEVC Main 10 (ExoPlayer / Media3) |
Android Media3 |
Xtream Codes v2 REST API Deep-Dive
Every modern player connects Reference Panel through the same HTTP handshake. The sequence below is what TiviMate, IPTV Smarters, and XCIPTV execute on login; you can reproduce each call in a browser or with curl.
1 Authentication handshake
GET http://line.server.example.com:8080/player_api.php?username=USERNAME&password=PASSWORD{
"user_info": {
"username": "USERNAME",
"status": "Active",
"auth": 1,
"exp_date": "1798761600",
"is_trial": "0",
"active_cons": "1",
"max_connections": "5",
"allowed_output_formats": ["m3u8", "ts", "rtmp"]
},
"server_info": {
"url": "line.server.example.com",
"port": "8080",
"https_port": "2086",
"server_protocol": "http",
"timezone": "UTC",
"timestamp_now": 1759795200
}
}auth must equal 1 and status "Active". exp_date is a Unix timestamp; max_connections caps concurrent streams; https_port exposes the TLS listener used to defeat SNI-based shaping.
2 Live category indexing & stream URL construction
GET http://line.server.example.com:8080/player_api.php?username=USERNAME&password=PASSWORD&action=get_live_categories[
{ "category_id": "12", "category_name": "UK | SKY SPORTS", "parent_id": 0 },
{ "category_id": "18", "category_name": "USA | ESPN & FOX SPORTS", "parent_id": 0 },
{ "category_id": "41", "category_name": "24/7 | PPV EVENTS", "parent_id": 0 }
]GET http://line.server.example.com:8080/player_api.php?username=USERNAME&password=PASSWORD&action=get_live_streams&category_id=12
# Stream URL template returned per stream_id:
http://line.server.example.com:8080/live/USERNAME/PASSWORD/STREAM_ID.ts
http://line.server.example.com:8080/live/USERNAME/PASSWORD/STREAM_ID.m3u83 EPG XMLTV synchronisation routine
curl -sS --compressed "http://line.server.example.com:8080/xmltv.php?username=USERNAME&password=PASSWORD" -o guide.xml
# Short-form EPG for a single channel (JSON, base64 descriptions):
GET http://line.server.example.com:8080/player_api.php?username=USERNAME&password=PASSWORD&action=get_short_epg&stream_id=STREAM_ID&limit=4<?xml version="1.0" encoding="UTF-8"?>
<tv generator-info-name="Reference Panel EPG">
<channel id="skysportsmainevent.uk">
<display-name>Sky Sports Main Event</display-name>
<icon src="https://cdn.example/logos/ssme.png"/>
</channel>
<programme start="20261006190000 +0000" stop="20261006210000 +0000" channel="skysportsmainevent.uk">
<title lang="en">Premier League Live</title>
<desc lang="en">Live coverage, 50 fps.</desc>
<category lang="en">Sports</category>
</programme>
</tv>4 M3U extended playlist equivalent
#EXTM3U
#EXTINF:-1 tvg-id="skysportsmainevent.uk" tvg-name="Sky Sports Main Event" tvg-logo="https://cdn.example/logos/ssme.png" group-title="UK | SKY SPORTS",Sky Sports Main Event FHD
http://line.server.example.com:8080/live/USERNAME/PASSWORD/10231.ts
# Full playlist export:
http://line.server.example.com:8080/get.php?username=USERNAME&password=PASSWORD&type=m3u_plus&output=tsXtream Codes API Protocol FAQ
What is Xtream Codes API Protocol in simple terms?
A REST-style HTTP API used by IPTV panels to authenticate a line and deliver live, VOD, series, and EPG metadata as JSON. Players call player_api.php with a username and password and receive user_info and server_info objects, then request categories and streams by action parameter.
Is Xtream Codes API the same as the original Xtream Codes software?
The protocol survived the 2019 shutdown of the original company and is now implemented by XUI.one, Xtream UI forks, and most commercial panels, so player apps remain compatible.
How far behind live are IPTV sports streams and can latency be reduced?
Standard HLS with 4-second segments and a 3-segment player window sits 12-18 seconds behind the broadcast. Low-Latency HLS with 0.5-second partial segments brings glass-to-glass delay to about 3.8 seconds, and raw MPEG-TS over HTTP (.ts output format) is typically 5-7 seconds behind. Choose the .ts output format in your player for live sports and reserve .m3u8 for VOD and catch-up.
What buffer size should I set in TiviMate, Smarters, or XCIPTV for 4K sports?
Set the largest option (5,000 ms in TiviMate, "Large" in Smarters). Buffer time in seconds equals buffer bytes multiplied by 8, divided by the stream bitrate in Mbps: a 15 MB allocation on an 18.5 Mbps 4K feed yields 6.5 seconds of protection, which covers typical ISP shaping bursts of 2-4 seconds without a visible freeze.
How do I know if my ISP is throttling IPTV streams, and how do I stop it?
Run a speed test on the same device while a stream buffers. If raw throughput is above 25 Mbps but the player reports a bitrate below 8 Mbps, your ISP is applying traffic shaping to the stream flow, usually triggered by deep packet inspection of the TLS SNI or by sustained UDP/TCP flows to known hosting ASNs. Stop it by routing the player through a WireGuard tunnel (which hides destination and SNI inside ChaCha20-Poly1305 encryption), switching DNS to 1.1.1.1 over HTTPS, and keeping a 5,000 ms player buffer so short shaping bursts never reach the decoder.
WireGuard vs OpenVPN: which VPN protocol is better for 4K IPTV?
WireGuard. It runs in the Linux kernel, uses a 4,000-line codebase with ChaCha20-Poly1305 encryption, and adds roughly 1-3 ms of latency with 5-8% throughput overhead, so an 18.5 Mbps 4K stream passes untouched. OpenVPN in TCP mode suffers from TCP-over-TCP meltdown during packet loss and typically costs 20-35% throughput; use OpenVPN only in UDP mode with tls-crypt on networks that block UDP port 51820.
How does multi-screen concurrency work and what happens if I exceed max_connections?
The Xtream Codes player_api.php handshake returns max_connections and active_cons. Each live or VOD stream request opens one session counted against that limit; a second TV, phone, or multi-view tile is a second connection. When active_cons would exceed max_connections, the server answers the new stream request with HTTP 403 / 458 and the player shows "max connections reached". Resellers should sell lines with 2-5 connections for households and enable IP-lock only for single-device subscribers.
Every external citation on this page points to a primary source: telecommunications RFCs, ITU-T and ISO codec standards, manufacturer and developer documentation, national regulators, or official sports governing bodies. No commercial IPTV competitor is cited.