Xtream Codes Login Explained: Server, Username and Password

Your provider’s email says something like Server: http://provider.example:8080, followed by a username and a password. Those three details are an Xtream Codes login. You don’t install anything called Xtream Codes: it is a login format, and any player that supports it can turn those three values into your channels, movies and series. This guide shows what each field is, what a player does with it behind the scenes, and how to read the server’s answer when a login loads nothing.

Key Takeaways

• An Xtream Codes login is three values: a server address with its port, a username and a password. Together they identify one account on your provider’s server.
• A player builds two kinds of request from them: get.php returns your whole channel list as M3U, and player_api.php returns account details and lists in JSON.
• Asking for output=m3u8 gives HLS stream addresses, which play on iPhone, iPad and Apple TV as well as Android.
• When a login loads no channels, the account details from player_api.php usually say why: a wrong password, an expired subscription, or too many devices at once.

What the three fields are

An Xtream Codes login is a server address, a username and a password that together identify one account on a provider’s server.

Field	What it looks like	Common mistakes
Server	http://provider.example:8080	Missing http://, missing port, an extra path such as /get.php, or https:// on a server that only answers http://
Username	Letters and digits from your provider	A space copied from the email at the start or end
Password	Letters and digits from your provider	A phone keyboard capitalising the first letter

The server is only the scheme, host and port. Everything after the port is added by the player. Kibo Player adds http:// when you leave it out and removes a trailing slash, but not every app does, so copy the server exactly as your provider wrote it.

Use only a login your provider issued for your own account. The player plays what the account gives it; it doesn’t provide any channels itself.

What a player does with them

From those three values a player builds addresses on your provider’s server. The two you are most likely to meet:

http://provider.example:8080/get.php?username=USER&password=PASS&type=m3u_plus&output=m3u8
http://provider.example:8080/player_api.php?username=USER&password=PASS

get.php returns the entire channel list as one M3U file. type=m3u_plus asks for the extended form that includes each channel’s logo and group, and output chooses the kind of stream address inside. If M3U is new to you, our explanation of M3U and M3U8 covers what is in that file.

player_api.php returns JSON. Called with only the login, it describes the account in a user_info object: whether the login was accepted, its status, its expiry date as a Unix timestamp, and how many connections it allows. Called with an action such as get_live_categories, get_live_streams, get_vod_streams or get_series, it returns those lists. Apps that support Xtream Codes use this to show live TV, movies and series as separate sections instead of one long list.

Individual channels then play from addresses in this shape:

http://provider.example:8080/live/USER/PASS/101.m3u8

One thing follows from all of this: your username and password are inside every address, and many provider servers use plain http, which, unlike HTTPS, is not encrypted. Enter your login only in apps you trust, and never post a screenshot of a playlist link or a channel address.

Why output=m3u8 matters

The same account can hand out two kinds of stream address:

• output=ts gives raw MPEG-TS addresses ending in .ts.
• output=m3u8 gives HLS addresses ending in .m3u8.

Android’s media player library, ExoPlayer, plays both: its supported formats page lists MPEG-TS as a progressive container and inside HLS. Apple’s players are built around HLS, and raw .ts addresses often fail on iPhone and iPad even though the same address plays on Android. So when you build an Xtream link by hand, or your provider offers a choice, take m3u8. Nothing about the account changes, only the shape of the addresses. The details are in why an IPTV stream won’t play on iPhone.

When the login works but no channels load

An empty list rarely means the player is broken. The quickest way to find out what happened is the account description that player_api.php returns. These are the fields to look at and what they mean:

What the server returns	What it means	What to do
"auth": 0	The username or password was rejected	Retype both, then check them with your provider
"status": "Expired", or an exp_date in the past	The subscription ended	Renew it with your provider
Another status, such as Banned or Disabled	The provider has blocked the account	Contact your provider
active_cons equal to max_connections	The account is already in use on its maximum number of devices	Stop playback on another device and try again
Everything active, but no channels	The server sent an empty list	Ask your provider whether playlist downloads are enabled for your account

Our player reads these fields itself when a download comes back empty, so it can show the reason in words instead of an empty screen.

There is one more cause we met while building our player: some servers answer with an empty playlist when the request doesn’t come from an app they recognise, such as a request carrying Android’s default HTTP client name. If one app loads your list and another loads nothing with the same login, this is the likely reason, and the fix is on the app’s side, not yours.

You can check the account description yourself by opening the player_api.php address above in a browser, with your own username and password. Do it on your own device: the address, password included, stays in the browser’s history.

Large lists need patience

For a big account, the server builds the get.php list at the moment you ask for it, and it can take a long time before the first byte arrives. A player that gives up after a few seconds can report a failed login on an account that is fine. If a first load seems stuck, give it a couple of minutes before changing anything.

Xtream Codes login or M3U link: which one to use?

They usually reach the same account. A get.php link is in fact an Xtream login written as a single address, with the username and password inside it.

• Use the Xtream Codes login when your player supports it. The player gets live TV, movies and series as separate, structured lists, and can explain errors using the account details.
• Use the M3U link when your player only accepts links, or when you want the exact list your provider generated.

Either way, the account’s connection limit applies to every device you add it to. If you plan to watch on a phone and a TV at once, check how many connections your account allows.

The short version

Server, username and password are all an Xtream Codes login is. Copy the server exactly, prefer m3u8 output, and when nothing loads, read the account description before reinstalling anything. When you are ready to put the login on a television, our guide to adding a playlist on Android TV and Google TV shows how to enter it without typing on a remote.

---

Written by the team that builds Kibo Player. We fact-checked every linked source on 10 November 2026. If something here has changed, tell us, and you can read more about us.