Last updated: July 7, 2026 | Reviewed by StreamingVPS.com Engineering Team
The Xtream Codes API is a login-based interface — not a static file — that lets IPTV player apps like TiviMate or IPTV Smarters pull live channels, VOD libraries, series, and EPG data on demand from a server URL, username, and password. It’s different from a plain M3U8 playlist, which is just a flat text list fetched once. If you’re building or hosting an IPTV service, understanding which one your setup actually needs — and what has to run on your VPS to support it — changes your whole architecture.
Key Takeaways
- The Xtream Codes API authenticates with a server URL, username, and password, then serves JSON responses through endpoints like
player_api.php?action=get_live_streams— it is not a downloadable playlist file. - A plain M3U8/M3U file is a static, one-time-fetch text list of stream URLs; it has no login, no live category filtering, and no built-in EPG sync.
- The original Xtream-Codes company was shut down by a multi-country law enforcement raid in September 2019, but the API format lives on through community forks like Xtream UI and the commercial XUI.one panel.
- Streaming engines like Wowza and Flussonic generate and deliver the actual video; neither speaks the Xtream Codes API natively, so a separate panel or middleware layer sits in front of them to translate.
- Running an Xtream-compatible panel is legal on its own — the legal risk is entirely about whether the channels behind it are properly licensed, not about the API format itself.
What Is the Xtream Codes API, Really?
Xtream Codes started as commercial panel software for managing an IPTV reseller business: user accounts, channel bouquets, credits, resellers-of-resellers, and a client-facing API that any compatible player app could authenticate against. The “API” part is what survived and matters technically today. A client app sends a request like:
http://yourdomain.com:8080/player_api.php?username=demo&password=demo
The server responds with a JSON object describing the account (expiry date, max connections, active status), and from there the app calls action-specific endpoints to pull categories and streams. This is the exact mechanism apps like TiviMate, IPTV Smarters Pro, and GSE Smart IPTV expect when you enter an “Xtream Codes login” instead of an M3U URL — three fields (host, username, password) instead of one long playlist link.
How Is the Xtream Codes API Different From a Plain M3U8 Playlist?
An M3U8 playlist is a text file, full stop. It lists stream URLs — often with #EXTINF metadata for channel name, logo, and group — and the player downloads it once and holds that list until you refresh it manually. There’s no session, no per-category loading, and EPG (if present) is usually a separate XMLTV file the player fetches on its own schedule.
The Xtream Codes API instead authenticates a session and returns data in small, filtered JSON chunks. When you open the “Sports” category in a player, it isn’t loading a 20,000-line playlist and filtering client-side — it’s calling get_live_streams with a category_id parameter and getting back just that category. This is also why Xtream-based services can push channel additions or removals instantly: the client re-queries live, it doesn’t re-download a static file.
| Plain M3U8 | Xtream Codes API | |
|---|---|---|
| Delivery mechanism | Static text file, fetched once | Authenticated JSON API, queried live |
| Login model | None (URL is the credential) | Username + password + server URL |
| Category filtering | Client-side, after full download | Server-side, per API call |
| VOD / series support | Requires separate playlists or none | Native (get_vod_streams, get_series) |
| EPG | Separate XMLTV file, manually synced | Served via get_short_epg / get_simple_data_table |
| Update propagation | Manual refresh required | Immediate on next API call |
What Do the Actual API Endpoints Look Like?
All requests go through a single player_api.php entry point with an action parameter. The core actions a typical panel implements:
| Endpoint action | What it returns |
|---|---|
| get_live_categories | List of live TV category groups (e.g. Sports, News, Movies) |
| get_live_streams | Channels in a category, or all channels if no category_id is passed |
| get_vod_categories / get_vod_streams | VOD library structure and individual titles |
| get_series / get_series_info | TV series, seasons, and episode metadata |
| get_short_epg | Now/next EPG entries for a given stream_id |
| get_simple_data_table | Fuller EPG guide data for a channel |
Actual stream playback then happens on a separate URL pattern — typically http://host:port/live/username/password/stream_id.m3u8 (or .ts) for live, and /movie/username/password/vod_id.ext for VOD — so the API handles catalog/auth, while the actual video bytes are served the same way any HLS or progressive stream would be. This is the layer where your streaming engine’s actual delivery performance matters: the panel can list a channel perfectly and the video can still stutter if the underlying VPS is undersized.
Is Xtream Codes Software Still Around in 2026?
Mostly through descendants, not the original. In September 2019, law enforcement across Italy, the Netherlands, France, and Bulgaria — coordinated via Eurojust — took down roughly 181 servers and seized more than 800,000 reseller accounts tied to Xtream-Codes, cutting off an estimated 50 million end users. The original company’s Italian legal case was later resolved in its favor on appeal, but the original panel product and its core team never really came back into active development.
What did continue is the API format and forked codebases. Xtream UI picked up the original open-source panel code after the raid, and the commercial XUI.one panel followed as a paid successor with ongoing updates. Because so many player apps hard-coded support for the player_api.php request pattern, the format itself became a de facto standard independent of who’s running the backend — similar to how “RSS” outlived any single RSS reader.
What Do You Need to Host an Xtream-Compatible IPTV Service on a VPS?
Two separate things, and conflating them is the most common setup mistake: a streaming engine that ingests and delivers the actual video, and a panel/middleware layer that speaks the Xtream Codes API to client apps.
Wowza Streaming Engine and Flussonic Media Server are excellent at the first job — transcoding, packaging to HLS, handling thousands of concurrent viewer connections — but neither one natively exposes player_api.php endpoints. Flussonic’s own team has been explicit on their community forum that Flussonic isn’t an Xtream Codes alternative and expects to sit behind middleware like Ministra/Stalker for subscriber-facing panel features (the same distinction covered in our IPTV middleware guide). Wowza is the same story: it’s the delivery engine, and panel-facing auth/catalog logic goes through its ModuleCustomAuthenticator or an external system.
| Layer | Job | Typical software | Runs where |
|---|---|---|---|
| Streaming engine | Ingest, transcode, package to HLS/RTMP | Wowza Streaming Engine, Flussonic, Ant Media | Dedicated streaming VPS, sized for viewer concurrency |
| Panel / middleware | Xtream API auth, catalog, EPG, billing | XUI.one, self-built player_api.php layer, Flussonic Catena, Ministra | Same VPS for small deployments, separate VPS once subscriber count grows |
| Client app | Consumes the API | TiviMate, IPTV Smarters Pro, GSE Smart IPTV | Viewer’s device |
For a small deployment (a few hundred channels, a few thousand active sessions), we’ve seen a 4 vCPU / 8GB VPS handle the panel layer comfortably, with the streaming engine on its own separate instance so a traffic spike on delivery doesn’t starve the panel’s database queries — and vice versa. Splitting these two roles across separate VPS instances is the single biggest reliability improvement we recommend once a deployment moves past the hobby stage.
Is Running an Xtream Codes Panel Legal?
The API format, the panel software, and the act of hosting it are not illegal by themselves — they’re just a client-server protocol, no different in principle from any streaming API. The legal exposure is entirely about content rights: distributing licensed broadcast channels you don’t have rights to, through any delivery mechanism, is what draws enforcement attention (as the 2019 case demonstrated). Legitimate uses — a hotel in-house channel lineup, a corporate video-on-demand library, a properly licensed regional broadcaster’s own app backend — run on the exact same API mechanics without any of that risk. If you’re evaluating a provider or building your own service, the licensing question is the one that actually matters, not which playlist format is in use.
FAQ
Is the Xtream Codes API the same thing as an M3U8 playlist?
No. An M3U8 file is a static text list of stream URLs fetched once, while the Xtream Codes API is a login-based JSON interface (player_api.php) that returns live categories, VOD, series, and EPG data dynamically on every request.
Is Xtream Codes software still available in 2026?
The original Xtream-Codes company was raided by European law enforcement in 2019 and its core team dissolved, but the API format survives through forks and clones such as Xtream UI and XUI.one, and it remains the de facto standard that IPTV player apps expect.
Does Wowza or Flussonic natively speak the Xtream Codes API?
No. Wowza Streaming Engine and Flussonic Media Server generate and deliver the actual video streams, but neither exposes player_api.php endpoints natively — you need a separate panel or middleware layer in front of them to speak Xtream Codes to client apps.
Is running an Xtream Codes panel legal?
The API format and panel software themselves are legal to run; what’s illegal is using them to distribute copyrighted broadcast content you don’t have rights to. Hosting your own licensed channels, a hotel/IPTV-in-a-box deployment, or a legitimate reseller of properly licensed content through an Xtream-compatible panel is no different from any other CDN delivery model.
What VPS specs do I need to run an Xtream-compatible IPTV panel?
For a panel serving a few hundred concurrent Xtream API sessions plus VOD/EPG queries, a 4 vCPU / 8GB VPS with SSD storage is a reasonable starting point, separate from whatever VPS is running your actual streaming engine (Wowza, Flussonic, or Ant Media).
Get Your Streaming Engine Right, Then Layer the Panel On Top
The Xtream Codes API only works well when the video underneath it is solid — a perfectly configured panel can’t fix a streaming engine that’s dropping frames under load. StreamingVPS.com ships Wowza, Flussonic, Ant Media, and other engines pre-installed and fully managed, live in 60 seconds, so you can focus on the panel and catalog layer instead of fighting server setup. See our Wowza streaming VPS plans or full pricing to get the delivery layer sorted first. Get a pre-installed streaming VPS from StreamingVPS.com — go live in 60 seconds.
Sources consulted: TorrentFreak — Xtream Codes IPTV System Targeted in Massive Police Operation, TorrentFreak — Xtream-Codes IPTV Company Declared Lawful, Flussonic Forum — Two auth backends, GitHub — player_api.php reference implementation.
