What Is Xtream Codes? Login Format, Setup and Safety

Xtream Codes is not an app, and it is not a subscription by itself. It is a login format: three pieces of text — a server address, a username and a password. A media player exchanges those three values with a provider's server to load channels and video-on-demand data.

Most explainers online either try to route you toward getting Xtream Codes access, or reduce the safety question to a single warning line. This guide does neither. It explains what the format actually is and shows the documented API shape behind it, using sanitized, fake data throughout. Then it gives you a real way to judge whether a source is safe to use.

This article does not distribute, sell or provide any Xtream Codes account, playlist or credential. It explains the technology only. IPTV Expert is a media player. It plays back sources you already have access to, and it does not supply, sell or generate accounts of any kind.

Key takeaways

• Xtream Codes is a login format — server URL, username, password — not a specific app, provider or piece of content.
• Login happens over an HTTP endpoint, historically player_api.php, that returns account status as JSON.
• This article gives no free or working credentials. "Free Xtream Codes" search results are commonly leaked or stolen access to an account someone else is subscribed to.
• Safety depends on the provider, not on the login format itself.

What is Xtream Codes, exactly?

Xtream Codes is a login and authentication format used by many IPTV provider control panels. It is not one company, one app or one piece of content. It is a shared way for a player to prove who you are to a server. Once that check passes, the player pulls down your channel list, video library and program guide.

The name comes from the original Xtream Codes panel software. European law enforcement raided operators tied to that software in September 2019. The operation took more than 200 servers offline across Germany, France and the Netherlands. Around 700,000 users lost access to the platform in the process (TorrentFreak coverage of the September 2019 police operation, fetched 2026-07-21). The original company stopped operating soon after. The login format it popularized kept spreading anyway. Many providers and successor panels still use the same server-username-password shape today. That includes the actively maintained Xtream-UI, which documents the same underlying API structure (Xtream-UI API reference, fetched 2026-07-21). That is why the term "Xtream Codes" still shows up constantly, years after the original software stopped operating.

This is different from an M3U source, which is a single playlist link rather than three separate credentials. If your provider gave you one link instead of a server, username and password, you likely have an M3U source. What Is an M3U Playlist? Formats, Examples and Player Setup covers that format in full.

What does the Xtream Codes login format look like?

Every Xtream Codes login needs three values.

1. Server URL. The protocol, host and usually a port, for example http://example-provider.test:8080. The port is not implied by the domain. It is typically typed as part of the server value, not a separate field.
2. Username. Assigned by your provider, case-sensitive.
3. Password. Also case-sensitive.

Panel documentation shows examples using ports like 80 and 25461. Neither is guaranteed for any specific provider. The port is whatever that provider assigned, not a fixed standard. (Xtream-UI API reference; community-maintained Xtream Codes API documentation, both fetched 2026-07-21.)

That is the whole format. Three values, typed once, checked against a server every time the app needs fresh data.

Inside the Xtream Codes API: a sanitized, annotated example

Once a player has your server, username and password, it authenticates over an HTTP endpoint historically located at player_api.php. The request looks like this, using clearly fake data only:

GET http://example-provider.test:8080/player_api.php?username=demo_user&password=demo_pass

No real server, account or working link is shown anywhere in this article. Every value above is a placeholder.

A successful response returns a JSON object. The important fields, again using fake sample values, look like this:

{
  "user_info": {
    "username": "demo_user",
    "auth": 1,
    "status": "Active",
    "exp_date": "1799999999",
    "active_cons": "0",
    "max_connections": "1"
  },
  "server_info": {
    "url": "example-provider.test",
    "port": "8080"
  }
}

What the JSON response fields mean

Here is what each field means in plain language:

• auth is 1 for a successful login and 0 for a failed one.
• status describes the account state, commonly "Active".
• exp_date is the subscription's expiration, usually a Unix timestamp.
• active_cons and max_connections describe how many devices are currently connected and how many are allowed at once.

On a failed login, panels commonly return a generic error string. One documented example is "NOT EXISTS" for a wrong username or password (Xtream-UI API reference, fetched 2026-07-21). That single detail explains a lot of user confusion. A real panel can distinguish a wrong password from an expired subscription internally. A player only shows you its own error screen, though, and if that screen is generic, the distinction never reaches you.

This is exactly why IPTV Expert's own Xtream Codes setup screen shows one shared "Refresh failed" message rather than inventing a more specific one the underlying API cannot reliably provide. The setup guide linked later in this article walks through what that screen means and how to narrow down the cause manually.

Once login succeeds, the same base endpoint accepts extra parameters to fetch channels, video-on-demand titles and program-guide data. You never see or type any of this directly. IPTV Expert handles the exchange for you once you enter your credentials in its own setup form.

That division of labor is worth noticing. The login format itself never changed to accommodate any single app. Every player, IPTV Expert included, is built to speak the same documented request-and-response shape described above. That is exactly why credentials from one Xtream Codes-compatible provider are not tied to one specific player.

Is Xtream Codes safe to use?

The login format itself is neutral. It says nothing about whether the specific content behind it is something the provider is licensed to offer. Safety and legitimacy depend on the provider you connect to, not on the three fields you type into a form.

Three questions to ask before you trust a source

Here is a practical way to judge a specific source, rather than a single yes-or-no answer this article cannot give on your behalf:

• Does the provider identify itself and offer real support? A provider you can actually contact, with a real business behind it, is a different situation from an anonymous handoff.
• Did you get it through an accountable relationship you chose? Your own subscription, billed to you by a provider you picked, is different from a credential someone handed you for free.
• Would you be comfortable if the content's rights holder saw the arrangement? This is a useful gut check when the first two answers are unclear.

None of these questions can be answered by the login format alone. They depend entirely on where the credentials came from.

This article does not answer the search for "free Xtream Codes," and it will not link you toward one. Free or leaked Xtream Codes credentials are commonly someone else's active account, shared or resold without the provider's knowledge. They tend to stop working without notice. The real subscriber or the provider can cut off access at any time. And if that happens, you have no support relationship with anyone to fall back on.

If you already have your own credentials from an accountable provider, that is the situation this article's companion guide covers. IPTV Expert does not supply, sell or generate Xtream Codes accounts of any kind. It only plays back sources you already have access to.

How is Xtream Codes different from M3U or Stalker Portal?

Xtream Codes is one of three common ways a player connects to a source. Knowing which one you have determines what you'll be asked to enter.

If your provider gave you a single link instead of three separate values, you likely have an M3U source instead, covered earlier in this guide. A portal address plus a MAC address means Stalker Portal instead. Best Stalker Portal IPTV Players in 2026 covers that format and compatible players.

Setting up Xtream Codes once you have credentials

If you already have a server, username and password from your own provider, entering them into a player is a short, specific form. How to Set Up Xtream Codes in IPTV Expert walks through the exact fields IPTV Expert asks for, in the order it asks for them. It also covers what the app's error screen means if the first attempt does not work.

If you have a playlist link instead of three separate credentials, How to Add an M3U Playlist to IPTV Expert covers that flow instead. If you have not installed a player yet, the full IPTV Expert download chooser covers every supported device.