🔑 Xtream Codes Login Explained 2026
"Login with Xtream Codes API" is the option most IPTV apps recommend, but the three fields it asks for confuse a lot of people. This guide explains exactly what the Xtream Codes API is, what each field means, how it differs from a plain M3U link, how to derive your M3U URL from your login, which apps support it, and how to fix the login errors people hit most.
📡 What is the Xtream Codes API?
The Xtream Codes API is a standard way IPTV servers talk to player apps. Originally part of a panel software many providers ran, the API has become a de-facto standard that almost every modern IPTV app supports. Instead of handing you a long static playlist file, the server exposes an interface that lets the app request your live channels, video-on-demand, series and program guide on demand.
In practice, "Xtream login" just means you authenticate to your provider's server with three pieces of information, and the app does the rest.
🧾 The three login fields
| Field | What it is | Example |
|---|---|---|
| Server URL | The address of your provider's server, including the port. Use the exact host and port they gave you, no trailing slash. | http://example-host.com:8080 |
| Username | Your account username (case-sensitive). | john123 |
| Password | Your account password (case-sensitive). | aBc!9xQ2 |
The most common mistakes are with the Server URL: people leave out the port (:8080), add an extra /, or paste a full get.php link into the server field. The server URL should be just the scheme, host and port — nothing more.
🔀 How it differs from a plain M3U
A plain M3U is a single static link or file containing every channel. An Xtream login is a live connection to the server. Functionally they often point at the same service, but:
- Xtream typically loads VOD and series with categories and posters; a plain M3U usually lumps everything into one long list.
- Xtream pulls the EPG through the API, which is often cleaner than matching an external XMLTV file.
- Xtream lets the app refresh content without you re-pasting a new link.
- A plain M3U is simpler and easier to hand-edit if you want full control over the file.
For a deeper comparison, read M3U vs Xtream Codes.
🔗 Deriving the M3U URL from Xtream credentials
Every Xtream account can also produce a plain M3U link, which is handy for apps that only accept M3U or for our tools. The pattern is:
http://HOST:PORT/get.php?username=USER&password=PASS&type=m3u_plus&output=tsSo for the example above:
http://example-host.com:8080/get.php?username=john123&password=aBc!9xQ2&type=m3u_plus&output=tsThe API itself is reached through player_api.php, which apps call behind the scenes to fetch categories, streams and EPG:
http://example-host.com:8080/player_api.php?username=john123&password=aBc!9xQ2You can paste the generated M3U link into our M3U Validator to confirm it works, or open it in the M3U Editor to tidy it up.
📱 Which apps support Xtream login?
Nearly all of them. The most popular include:
- IPTV Smarters Pro — "Login with Xtream Codes API" (see our Smarters guide).
- TiviMate — Add playlist → Xtream Codes (see the TiviMate guide).
- XCIPTV, Smarters Player Lite, Sparkle TV and many others.
- Smart-TV players such as the Tizen/webOS builds of IPTV Smarters.
- Kodi via add-ons (see the Kodi setup guide).
🛠️ Troubleshooting login errors
| Error | Cause & fix |
|---|---|
| "Invalid credentials" / login failed | Typo in username/password (check capitals, no leading/trailing spaces). Re-type carefully. |
| Wrong port | The port (e.g. :8080, :80, :25461) is part of the server URL. Use the exact one your provider gave you. |
| http vs https | Some servers use http://, others https://. Try the other scheme if it won't connect. |
| Expired account | The subscription has run out or wasn't activated. Confirm with your provider. |
| "Max connections reached" | You're streaming on more devices than your plan allows. Close a session or upgrade. |
| Server offline / timeout | The provider's server is down or under maintenance. Test the player_api.php URL in a browser; wait and retry. |
| Works on M3U but not Xtream (or vice-versa) | Use the alternative login method; some servers expose one endpoint more reliably than the other. |
🔐 A quick security note
Your Xtream credentials are sent in the URL itself, often over plain http. Treat them like a password:
- Don't post your full server URL, username or password in forums, screenshots or support tickets — anyone with them can use (and exhaust) your connections.
- Prefer providers that offer
httpsso credentials aren't exposed in plain text on the network. - If you're on public Wi-Fi or unsure about your provider's privacy, use a VPN (see our IPTV VPN guide).
- If your account starts hitting "max connections" unexpectedly, your details may have leaked — ask your provider to reset them.