What Is Xtream Codes? IPTV Authentication Explained
The username/password/server-URL combination every IPTV provider sends in their welcome email. What it actually is and why it works the way it does.
- What Xtream Codes actually is (technically)
- Why providers prefer it over M3U URLs
- How to use it in TiviMate, IBO, Smarters Pro
- Security: what your credentials grant
What Xtream Codes is
Xtream Codes is a software package — historically the most popular IPTV server software in the world — that ran on Linux servers and managed live TV streaming, VOD libraries, EPG data, and user authentication. The original company was based in Cyprus and provided server software that thousands of IPTV providers ran on their own infrastructure.
The original Xtream Codes company was raided in 2019 by Italian authorities and the company itself shut down. But the API protocol they invented — a JSON-over-HTTP authentication and stream-routing standard — became the de-facto industry format. Modern IPTV servers run open-source software (XUI.one, OttRun, and successors) that all speak the original Xtream Codes API protocol.
When your IPTV provider says "use Xtream Codes API", they mean: connect to our server using the Xtream Codes API specification, authenticate with the username and password we issued you, and request streams from our channel and VOD endpoints.
What's in the welcome email
Every IPTV provider sends three pieces of information when you subscribe:
Server URL: a hostname like http://server.example.com:8080. The port is usually 8080 (sometimes 80, 8000, or 25461). This is the entry point for authentication and stream requests.
Username: a 6-12 character alphanumeric string assigned to your account. This identifies which subscription is requesting streams.
Password: another 6-12 character string. Combined with the username, this authorises the request.
Some providers also send an M3U URL — a single URL that combines all three pieces into one. M3U URLs are easier to copy-paste but less robust (more on this below). Xtream Codes credentials are the more capable format and what TiviMate, IBO Player, and Smarters Pro all default to.
Why providers prefer Xtream Codes over M3U URLs
M3U URLs are simpler — one URL that, when fetched, returns a plaintext playlist of every channel you have access to. The IPTV player parses the playlist and displays a channel grid. Xtream Codes is more complex — the player calls multiple API endpoints (live channels, VOD, series, EPG) and stitches them into a UI.
Three reasons the industry moved to Xtream Codes for IPTV apps:
EPG (TV guide) data integration. Xtream Codes provides 7-day EPG data through a dedicated API endpoint. M3U playlists alone don't carry EPG — the player has to fetch a separate XMLTV file and match channel names. The Xtream Codes integration is far cleaner.
VOD organisation. Xtream Codes separates VOD into films and series with proper metadata (title, description, year, genre, cast, posters). M3U treats everything as a flat playlist of stream URLs.
Failover and load balancing. The Xtream Codes API can return different stream sources depending on server load, time of day, or geographic region. M3U URLs are static — every user gets the same stream list regardless of conditions.
For day-to-day IPTV use, Xtream Codes provides a richer experience. M3U URLs are still supported as a fallback for older players and edge cases.
Configuring Xtream Codes in the major IPTV players
TiviMate (Android TV, Fire TV). Settings → Add Playlist → Enter URL → choose "Xtream Codes API". Paste the server URL into the Server field, username and password into their respective fields. Tap Done.
IBO Player Pro (Smart TV, Apple TV, Firestick). On first launch, choose "Add Playlist" → "Xtream Codes API". Paste the same three values. Give the playlist a friendly name ("ITS IPTV").
Smarters Pro (every platform). Tap "Login with Xtream Codes API". Enter server URL (without "http://" — Smarters adds it automatically), username, password.
GSE Smart IPTV (Apple TV, iOS). Tap the + icon → Xtream Codes API. Same three fields.
In every case, the channel and VOD lists load automatically within 5-10 seconds. If they don't load, the most common cause is a typo in the username or password — copy directly from the welcome email rather than typing manually.
What your Xtream Codes credentials actually grant
Your Xtream Codes credentials are the equivalent of a Netflix password — they grant access to your IPTV subscription, nothing more. Anyone with your credentials can play your IPTV channels (potentially using your simultaneous-stream count). They cannot see your billing details, change your subscription tier, or access any data outside the IPTV service itself.
Best practices: don't share credentials with people outside your household; if you suspect they've leaked, email your provider for a fresh set; treat them like any other media-service password.
Note that Xtream Codes credentials are typically transmitted over HTTP (not HTTPS) for performance reasons — the streaming endpoints are HTTP-only on most providers. This is industry-standard for IPTV but does mean someone monitoring your local network could see the credentials in plaintext. For untrusted networks (hotel Wi-Fi, public Wi-Fi), pair IPTV with a VPN to encrypt the traffic.
Frequently asked
Try ITS IPTV
14-day satisfaction guarantee. No contract. Cancel from your account in one click.
View IPTV plans