What is Xtream Codes API Protocol?
Protocol Definition & Architecture: Reseller Configuration
Technical Definition
A REST-style HTTP API used by IPTV panels to authenticate a line and deliver live, VOD, series, and EPG metadata as JSON. Players call player_api.php with a username and password and receive user_info and server_info objects, then request categories and streams by action parameter.
How It Operates Under the Hood
Stream URLs are constructed as http://host:port/live/USER/PASS/STREAM_ID.ts (or .m3u8), http://host:port/movie/USER/PASS/ID.ext, and http://host:port/series/USER/PASS/ID.ext. EPG is fetched from xmltv.php and M3U playlists from get.php?type=m3u_plus.
Reseller Panel Configuration
Resellers should verify Xtream Codes API Protocol on every new line with a 24-hour trial before invoicing. Document the expected values in your onboarding message so customers can self-serve, and escalate to the provider desk with a Wireshark capture when behaviour deviates.
Protocol Engineering Specifications
| Stream Engineering Metric | Reference Specification | Governing Standard |
|---|---|---|
| Auth endpoint | player_api.php?username&password |
JSON over HTTP/1.1 |
| Catalog actions | get_live_categories, get_live_streams, get_vod_streams, get_series |
Query parameter action= |
| Ports | 8080 (HTTP), 2086 / 443 (HTTPS) |
server_info.https_port |
| Transport Container | MPEG-TS (188 bytes: 4 B header + 184 B payload, 0x47 sync) |
ISO/IEC 13818-1 |
| Manifest Specification | Extended M3U8 playlist / LL-HLS 0.5 s parts |
IETF RFC 8216 |
| Decoder Pipeline | Hardware MediaCodec HEVC Main 10 (ExoPlayer / Media3) |
Android Media3 |
Xtream Codes v2 REST API Deep-Dive
Every modern player connects Reference Panel through the same HTTP handshake. The sequence below is what TiviMate, IPTV Smarters, and XCIPTV execute on login; you can reproduce each call in a browser or with curl.
1 Authentication handshake
GET http://line.server.example.com:8080/player_api.php?username=USERNAME&password=PASSWORD{
"user_info": {
"username": "USERNAME",
"status": "Active",
"auth": 1,
"exp_date": "1798761600",
"is_trial": "0",
"active_cons": "1",
"max_connections": "5",
"allowed_output_formats": ["m3u8", "ts", "rtmp"]
},
"server_info": {
"url": "line.server.example.com",
"port": "8080",
"https_port": "2086",
"server_protocol": "http",
"timezone": "UTC",
"timestamp_now": 1759795200
}
}auth must equal 1 and status "Active". exp_date is a Unix timestamp; max_connections caps concurrent streams; https_port exposes the TLS listener used to defeat SNI-based shaping.
2 Live category indexing & stream URL construction
GET http://line.server.example.com:8080/player_api.php?username=USERNAME&password=PASSWORD&action=get_live_categories[
{ "category_id": "12", "category_name": "UK | SKY SPORTS", "parent_id": 0 },
{ "category_id": "18", "category_name": "USA | ESPN & FOX SPORTS", "parent_id": 0 },
{ "category_id": "41", "category_name": "24/7 | PPV EVENTS", "parent_id": 0 }
]GET http://line.server.example.com:8080/player_api.php?username=USERNAME&password=PASSWORD&action=get_live_streams&category_id=12
# Stream URL template returned per stream_id:
http://line.server.example.com:8080/live/USERNAME/PASSWORD/STREAM_ID.ts
http://line.server.example.com:8080/live/USERNAME/PASSWORD/STREAM_ID.m3u83 EPG XMLTV synchronisation routine
curl -sS --compressed "http://line.server.example.com:8080/xmltv.php?username=USERNAME&password=PASSWORD" -o guide.xml
# Short-form EPG for a single channel (JSON, base64 descriptions):
GET http://line.server.example.com:8080/player_api.php?username=USERNAME&password=PASSWORD&action=get_short_epg&stream_id=STREAM_ID&limit=4<?xml version="1.0" encoding="UTF-8"?>
<tv generator-info-name="Reference Panel EPG">
<channel id="skysportsmainevent.uk">
<display-name>Sky Sports Main Event</display-name>
<icon src="https://cdn.example/logos/ssme.png"/>
</channel>
<programme start="20261006190000 +0000" stop="20261006210000 +0000" channel="skysportsmainevent.uk">
<title lang="en">Premier League Live</title>
<desc lang="en">Live coverage, 50 fps.</desc>
<category lang="en">Sports</category>
</programme>
</tv>4 M3U extended playlist equivalent
#EXTM3U
#EXTINF:-1 tvg-id="skysportsmainevent.uk" tvg-name="Sky Sports Main Event" tvg-logo="https://cdn.example/logos/ssme.png" group-title="UK | SKY SPORTS",Sky Sports Main Event FHD
http://line.server.example.com:8080/live/USERNAME/PASSWORD/10231.ts
# Full playlist export:
http://line.server.example.com:8080/get.php?username=USERNAME&password=PASSWORD&type=m3u_plus&output=tsXtream Codes API Protocol FAQ
What is Xtream Codes API Protocol in simple terms?
A REST-style HTTP API used by IPTV panels to authenticate a line and deliver live, VOD, series, and EPG metadata as JSON. Players call player_api.php with a username and password and receive user_info and server_info objects, then request categories and streams by action parameter.
Is Xtream Codes API the same as the original Xtream Codes software?
The protocol survived the 2019 shutdown of the original company and is now implemented by XUI.one, Xtream UI forks, and most commercial panels, so player apps remain compatible.
How are reseller credits priced and how is the margin calculated?
Credits are bought in tiers: $3.00 each at 50 credits, $2.20 at 100, $1.80 at 250, and $1.40 at 500+. One credit creates a 1-month line that retails for $10-$15. At the Pro tier (100 credits for $220) sold at $12/month, gross revenue is $1,200 and net profit is $980, a 445% return on the credit purchase.
How does multi-screen concurrency work and what happens if I exceed max_connections?
The Xtream Codes player_api.php handshake returns max_connections and active_cons. Each live or VOD stream request opens one session counted against that limit; a second TV, phone, or multi-view tile is a second connection. When active_cons would exceed max_connections, the server answers the new stream request with HTTP 403 / 458 and the player shows "max connections reached". Resellers should sell lines with 2-5 connections for households and enable IP-lock only for single-device subscribers.
What is device MAC address binding and why does my MAG box or Smart TV app ask for it?
Stalker / Ministra middleware authenticates a set-top box by its 48-bit MAC address (MAG boxes use the 00:1A:79 OUI prefix) instead of a username and password. The reseller panel binds that MAC to a subscription line; apps such as IBO Player and Smarters on Samsung or LG TVs generate a virtual MAC that must be registered the same way. If you replace the device, the panel must re-bind the new MAC or the portal returns an "unregistered device" error.
Do providers offer a free trial and how long does activation take?
Every network in this directory issues 24-hour trial lines from the reseller panel. Activation is instant: the panel writes the line to the Xtream database and the player can authenticate within 10 seconds. Trial lines are usually limited to 1 connection and exclude PPV bouquets.
What is the difference between Xtream Codes API, M3U URL, and Stalker Portal login?
All three deliver the same channels. Xtream Codes API uses player_api.php JSON endpoints so the player lazy-loads categories and EPG in seconds. An M3U URL (get.php) downloads a single text playlist of every stream, which is slow with 45,000 channels but works on any player. Stalker Portal authenticates by MAC address through a /c/ portal URL and is used by MAG receivers and some Smart TV apps.
Every external citation on this page points to a primary source: telecommunications RFCs, ITU-T and ISO codec standards, manufacturer and developer documentation, national regulators, or official sports governing bodies. No commercial IPTV competitor is cited.