player_api.php. Apps authenticate with a GET request to http://SERVER:PORT/player_api.php?username=USER&password=PASS and add an action parameter to list categories, live streams, VOD, series and EPG. Xtream-Masters panels expose a fully compatible API, so standard Xtream Codes players work unchanged.
| Xtream Codes API key facts | |
|---|---|
| Endpoint file | player_api.php on the streaming server: http://SERVER:PORT/player_api.php |
| Method | HTTP GET |
| Authentication | username and password of a line, sent as query parameters on every request |
| Response format | JSON, UTF-8 |
| Port | The streaming port of your panel, not the admin panel port |
| Live stream URL | /live/USER/PASS/STREAM_ID.ts or .m3u8 |
| Movie (VOD) URL | /movie/USER/PASS/STREAM_ID.EXT |
| Series episode URL | /series/USER/PASS/EPISODE_ID.EXT |
| EPG | xmltv.php (full XMLTV guide), get_short_epg and get_simple_data_table (per stream) |
| M3U playlist | get.php?username=USER&password=PASS&type=m3u_plus&output=ts |
| Compatible players | Apps with an "Xtream Codes" or "Xtream API" login, and the Xtream-Masters white-label player |
| Official reference | Xtream-Masters Player API documentation |
On this page
How the Xtream Codes API works
The Xtream Codes API started in the Xtream Codes panel and became the de facto standard for IPTV players. Panels in the same family, such as Xtream UI, XUI.ONE and Xtream-Masters, keep the same player_api.php interface so existing apps keep working. A player app follows the same flow on every compatible panel:
- Login. The app calls
player_api.phpwith onlyusernameandpassword. The response holdsuser_info(account status, expiry, connections) andserver_info(URL, ports, protocol, timezone). - Browse. The app adds
action=get_live_categories,get_vod_categoriesorget_series_categories, then loads the streams of a category. - Details. For movies and series it calls
get_vod_infoorget_series_infoto get metadata, seasons and episodes. - Play. The app builds the stream URL from the server, the credentials and the stream ID (see stream URL formats).
player_api.php endpoint reference
All actions are GET requests to http://SERVER:PORT/player_api.php?username=USER&password=PASS plus the parameters below. Parameter names are exactly as the panel expects them.
| Action | Extra parameters | Returns |
|---|---|---|
| (no action) | none | Authentication: user_info and server_info |
get_live_categories | none | Live TV categories |
get_live_streams | category_id (optional) | All live streams, or the streams of one category |
get_vod_categories | none | VOD (movie) categories |
get_vod_streams | category_id (optional) | All movies, or the movies of one category |
get_vod_info | vod_id (required) | Details of one movie |
get_series_categories | none | Series categories |
get_series | category_id (optional) | All series, or the series of one category |
get_series_info | series_id (required) | Details of one series with its seasons and episodes |
get_short_epg | stream_id (required), limit (optional) | Short EPG (upcoming programmes) for one live stream |
get_simple_data_table | stream_id (required) | All EPG data for one live stream |
The full XMLTV guide for all streams is a separate file: http://SERVER:PORT/xmltv.php?username=USER&password=PASS.
get_vod_latest and get_series_latest (the 100 latest added movies or series) and action=search with type=live, movies or series and a URL-encoded context search string. Other panels may not support these, so check before you depend on them.
Stream URL formats
Stream URLs are not returned as full links. The app builds them from the server address, the credentials and the IDs from the API responses. Replace the placeholders with your own values:
Which live formats a line may use is listed in user_info.allowed_output_formats of the login response (for example m3u8, ts, rtmp).
Example requests with curl
Use -G with --data-urlencode so special characters in usernames and passwords are encoded correctly.
Authenticate (login)
List live categories, then the streams of one category
Movie details, series episodes and short EPG
Login response structure
A successful login returns two objects. The field names below are from the Xtream-Masters Player API reference; the values are placeholders. Many numeric fields arrive as strings, and exp_date and created_at are Unix timestamps.
Check user_info.auth (1 means logged in) and user_info.status before you load content, and use server_info to pick the protocol and port for stream URLs.
Xtream Codes API vs M3U playlist
The same line works both ways. To turn an Xtream Codes API login into an M3U playlist, call get.php with the same credentials:
| Point | Xtream Codes API (player_api.php) | M3U playlist (get.php) |
|---|---|---|
| Format | JSON, one request per screen or category | One text file with every stream |
| Movies and series | Separate sections with info, seasons and episodes | Flat list of entries |
| EPG | get_short_epg, get_simple_data_table, xmltv.php | Separate XMLTV URL (xmltv.php) |
| Account info | Expiry, status and connections in user_info | Not included |
| Loading speed on large lists | Loads only what the screen needs | Downloads and parses the whole file |
| Best for | Player apps with live, VOD and series sections | Simple players, set-top boxes and quick tests |
Xtream Codes compatible API in Xtream-Masters
The Xtream-Masters OTT panel exposes four APIs. Two are for player apps, two are for automating your business:
| API | Used by | What it does | Documentation |
|---|---|---|---|
| Player API | Player apps | Xtream Codes compatible player_api.php: login, content lists, EPG | Player API |
| ActiveCode API | ActiveCode player apps | Player API login with a device-bound ActiveCode instead of username and password. The mac (Device ID) parameter is required on every API, stream and EPG URL | ActiveCode API |
| Reseller API | Reseller websites and bots | Automate reseller operations | Reseller API |
| Admin API | Your own back office | Create and manage client accounts, generate subscription links, handle admin access | Admin API |
How to enable each API
Player API
Nothing to enable. Every active line can call player_api.php on your streaming port. For ActiveCode apps, see ActiveCode IPTV player app.
Reseller API
Admin Menu, Reseller Members, Members Group: edit the reseller group and allow Reseller Use API. Then Admin Menu, System Security, Access Codes: create a reseller API access code (end-point). The reseller creates the key under Reseller Menu, API Documentation.
Admin API
Menu, Admin API: create an API key. Then Menu, System Security, Access Codes: create an admin API access code (end-point).
Security
- Access codes: the Reseller and Admin APIs only answer on the access code (end-point) you create, not on a public default path.
- Keep keys on your server: never put a Reseller or Admin API key inside an app. Call those APIs from your own backend. Rotate API keys quarterly, as the panel FAQ recommends.
- Firewall: keep admin and SSH ports limited to known IP addresses and open only the streaming ports your customers need.
- Abuse protection: Server Guard in front of every Xtream-Masters server filters Layer-7 DDoS, brute-force and API abuse.
Coming from another panel? Your lines keep working with the same apps after a move, because the Player API stays Xtream Codes compatible. See migrate Xtream UI or XUI.ONE to Xtream-Masters, NXT panel alternative, Xtream Codes alternative and best IPTV panel software.
Common errors and fixes
| Symptom | Likely cause | Fix |
|---|---|---|
"auth": 0, empty user_info, or HTTP 401 / 403 | Wrong username or password, or the line is disabled, banned or expired. Panels differ in which of these they return | Check the line in the panel, its status and exp_date. URL-encode special characters in the credentials |
| Connection refused or timeout | Wrong port, often the admin panel port instead of the streaming port, or a firewall rule | Use the streaming port shown in server_info.port and make sure it is open |
| Works over HTTP, fails over HTTPS | SSL is not set up on that port, or the app uses the HTTP port with https:// | Use http://, or https:// with server_info.https_port once SSL is configured |
| Login works, streams do not play | Output format not allowed, too many connections, or a wrong extension | Compare with allowed_output_formats, active_cons and max_connections, and use container_extension for movies and episodes |
| Requests start failing after many calls | Brute-force or flood protection blocking the client IP | Cache category and stream lists instead of requesting them on every screen, and stop retrying failed logins in a loop |
| ActiveCode login fails | Missing mac (Device ID) on one of the URLs | Send the same Device ID on every API, stream and EPG URL |
Sources: Xtream-Masters Player API documentation, ActiveCode API documentation and OTT panel FAQ, checked 3 November 2026.
