What is the base URL of the Xtream Codes API?

The API is served from the portal host via a file named player_api.php. If your portal host is http://provider.example:8080, the API base is http://provider.example:8080/player_api.php.

Is the Xtream Codes API JSON or XML?

Modern portals return JSON by default. Some older portal versions default to XML; you can request JSON explicitly by adding the parameter &format=json.

How do I check if my credentials are valid?

Call the API without an action, for example GET /player_api.php?username=USER&password=PASS. The response contains a user_info object with an auth flag (1 or 0) and a status field.

Do I need an API key?

No. The API authenticates with your standard Xtream Codes username and password. There is no separate API key.

Xtream Codes API: The Complete Reference

The Xtream Codes player API is the engine behind every IPTV player’s “Xtream Codes” login option. This reference covers the endpoints, parameters, and response shapes you need to integrate with it — or simply to understand what your player is doing.

Scope and permission

This reference documents how the API behaves on portals in the wild. Use it only against services you are authorized to access. Credentials are transmitted in URLs, so always use HTTPS where the portal supports it and never share requests containing your username and password.

API base and authentication

The API lives at a single entry point, player_api.php, relative to the portal host.

http://HOST:PORT/player_api.php?username=USERNAME&password=PASSWORD

Authentication uses your standard Xtream Codes credentials — there is no API key. Every request must include username and password.

Ports you will commonly see

Portals frequently run on ports like 80, 8080, 8000, 8888, 8899, or 25461. Your provider’s host string includes the correct port — use it exactly as given.

Authentication check

Calling player_api.php with only username and password performs an authentication check. It returns account info, server info, and — depending on the portal version — the full category and stream lists.

curl "http://provider.example:8080/player_api.php?username=USERNAME&password=PASSWORD"

A valid response contains a user_info object:

{
  "user_info": {
    "username": "USERNAME",
    "password": "PASSWORD",
    "auth": 1,
    "status": "Active",
    "exp_date": "1767225600",
    "is_trial": "0",
    "active_cons": "1",
    "created_at": "1712000000",
    "max_connections": "2",
    "allowed_output_formats": ["m3u8", "ts"]
  },
  "server_info": {
    "url": "provider.example",
    "port": "8080",
    "https_port": "8443",
    "server_protocol": "http"
  }
}

Key user_info fields:

Field	Meaning
`auth`	`1` = authenticated, `0` = failed
`status`	`Active`, `Expired`, `Disabled`, or `Trial`
`exp_date`	Expiry date as a Unix timestamp
`max_connections`	Simultaneous stream limit
`active_cons`	Currently used connections

When credentials are wrong, auth is 0. When the account is expired or disabled, status reflects that even though the password is correct.

Requesting JSON explicitly

Some portals default to XML, especially older versions. Request JSON with the format parameter:

player_api.php?username=USER&password=PASS&format=json

Actions reference

Append an action parameter to fetch specific data. The most important actions:

Action	Purpose
`get_live_categories`	Live channel categories
`get_live_streams`	All live channels
`get_live_streams_by_category`	Live channels in one category
`get_vod_categories`	Movies categories
`get_vod_streams`	All movies
`get_vod_streams_by_category`	Movies in one category
`get_series_categories`	Series categories
`get_series`	All series
`get_series_info`	Seasons and episodes for one series
`get_short_epg`	Program guide for a channel
`get_simple_data_table`	Legacy EPG table
`get_all_epg`	Full EPG for a channel

Live channel categories

curl "http://provider.example:8080/player_api.php?username=USER&password=PASS&action=get_live_categories"

[
  { "category_id": "1", "category_name": "News", "parent_id": 0 },
  { "category_id": "5", "category_name": "Sports", "parent_id": 0 }
]

Live streams

curl "http://provider.example:8080/player_api.php?username=USER&password=PASS&action=get_live_streams"

[
  {
    "num": 1,
    "name": "Example News HD",
    "stream_type": "live",
    "stream_id": 1001,
    "stream_icon": "https://.../logo.png",
    "category_id": "1",
    "epg_channel_id": "examplenews.hd"
  }
]

Live streams filtered by category

player_api.php?username=USER&password=PASS&action=get_live_streams_by_category&category_id=5

Series info (seasons and episodes)

player_api.php?username=USER&password=PASS&action=get_series_info&series_id=42

The response nests seasons, each containing its episodes.

EPG data

Live channels expose a program guide through EPG actions. A typical request for the next programs on one channel:

player_api.php?username=USER&password=PASS&action=get_short_epg&stream_id=1001&limit=4

limit controls how many programs are returned. Older portals use get_simple_data_table with limit as well; the response shape differs between portal versions.

Building stream URLs from API data

Each stream item gives you a stream_id. The playback URL is built from the portal host plus your credentials:

Live channel

http://HOST:PORT/live/USERNAME/PASSWORD/1001.m3u8

Movie (VOD)

http://HOST:PORT/movie/USERNAME/PASSWORD/2001.m3u8

Series episode

http://HOST:PORT/series/USERNAME/PASSWORD/42/1/3.m3u8

Both .m3u8 (HLS) and .ts (MPEG-TS) extensions are common; allowed_output_formats in user_info tells you which the account supports.

Stream URLs contain credentials

The URL pattern above embeds your username and password. Anyone with the URL can authenticate as you, so never log, share, or screenshot these URLs.

Full M3U and EPG via convenience endpoints

Beyond the JSON API, portals expose two classic playlist endpoints:

Full M3U playlist

http://HOST:PORT/get.php?username=USERNAME&password=PASSWORD&type=m3u_plus&output=ts

EPG XML

http://HOST:PORT/xmltv.php?username=USERNAME&password=PASSWORD

These are what apps use when you choose “playlist URL” instead of an Xtream Codes login. See Xtream Codes M3U and Xtream Codes EPG for details.

Error handling checklist

auth: 0 — wrong username or password.
status: Expired/Disabled — account problem; credentials are fine.
Empty arrays for streams — the account may be a trial with no content, or the category is empty.
HTTP errors (403/404) — wrong port, portal offline, or an IP block. Try HTTPS, re-check the host, and contact your provider.

Security for developers

Use HTTPS whenever the portal offers it.
Treat credentials as secrets: store them encrypted, never in client-side code that ships to users.
Validate and rate-limit your own API integrations.
Do not build, distribute, or use tools intended to bypass access controls on services you don’t own.

Next steps

What is Xtream Codes? — the concepts behind the API.
Xtream Codes URL explained — the three parts of every connection.
Xtream Codes player — how apps consume this API.
Xtream Codes security — protecting credentials and streams.