Xtream Codes: everything explained in 2026 (API, security, setup)

If you've ever configured an IPTV subscription on TiviMate, Smarters Pro or IBO Player, you've likely seen three fields: host (or server URL), username, password. This trio is called Xtream Codes — an API that redefined how IPTV players talk to servers. This guide explains it all, from internals to security best practices.

What is the Xtream Codes API?

Xtream Codes was originally an IPTV provider management panel, created in the 2010s. Its REST API exposed channel lists, EPG (program guide), VOD and series through standard endpoints. Even after the original company shut down, the protocol remained a de-facto standard — adopted by virtually every IPTV server and every serious player.

Concretely, a trio like http://example.com:80 / your_login / your_password lets the app dynamically fetch: the live list (~66,000 channels), the 7-day EPG grid, the VOD catalog with posters, the series with seasons and episodes.

Xtream Codes vs M3U: comparison

• M3U format: single URL, static content, no native EPG, ideal for Kodi/VLC.
• Xtream Codes: API trio, dynamic content, EPG + VOD + Series included, required for TiviMate.
• Updates: M3U downloads as one block; Xtream loads per-category on demand.
• Multi-device: both formats support multiple connections per your subscription tier.

Anatomy of an Xtream Codes setup

The host (server URL)

The host is your IPTV server's address, e.g. http://line.atvcorner.com:80. It includes protocol (http or https), domain, and port. Port 80 is standard HTTP, 443 is HTTPS, 8080 and 25461 are sometimes used by specific servers.

The username and password

Your unique login and password — tied to your subscription. Never share them: a single username allows only the number of simultaneous connections your plan permits (1, 2, 3 or more).

Accessible endpoints

Once authenticated, the app accesses URLs like /player_api.php?action=get_live_categories or /player_api.php?action=get_vod_streams. That's why TiviMate can load just the Sports category when you open it, not all 60,000 other entries.

Configuring Xtream Codes on main players

TiviMate (Android TV)

1. Open TiviMate, choose Add playlist.
2. Select Xtream Codes (or Stalker Portal depending on version).
3. Fill in: profile name, server URL (the host), username, password.
4. Confirm. TiviMate downloads the list and EPG in the background.

IPTV Smarters Pro

1. Add New User → Login with Xtream Codes API.
2. Fill the three fields + a profile name.
3. The app syncs all categories in under a minute.

IBO Player

On ibo.tv, add your device by MAC, then choose Xtream Codes instead of M3U URL. Enter host (often without the port), username, password.

Security: protecting your Xtream account

• Never share your host/user/pass trio — anyone with access can consume your connections and get the server banned.
• If you suspect a leak, contact your provider to regenerate the password.
• Beware sites offering "free Xtream accounts": they're stolen credentials, illegal, and stop working within 24h.
• Prefer HTTPS servers when your provider offers them — credentials get encrypted in transit.

Troubleshooting Xtream Codes errors

"User and password incorrect": check for leading/trailing whitespace (most common issue). "Server is offline": try without the port, or with another port (80, 8080, 25461). "Max connections reached": another device is already using your subscription — disconnect it or upgrade to a higher concurrent-connection plan.