Login format
Xtream Codes login — three fields, explained
An Xtream Codes login is a server URL, a username and a password. That is the entire protocol. Most setup problems are one of those three in the wrong box, or a URL copied without its port — so this page is about the fields, not the app.
What Xtream Codes actually is
Xtream Codes is a login format, not a service and not an app. It is the three-field way of handing a player your account: where the server is, who you are, and the password. Players label it “Xtream Codes API” or “Xtream Codes login”; underneath it is one HTTP endpoint that returns your channel list, your guide and your on-demand library.
It is worth knowing that because the name gets used as if it were a product. You do not buy “Xtream Codes” from anyone. You buy a subscription, and the subscription arrives as either an Xtream login or an M3U playlist — the same account in two shapes.
The three fields
| Field | What it looks like | The usual mistake |
|---|---|---|
| Server URL | http://host.example.com:8080 | Missing the port, or https where the server speaks http |
| Username | A short string, sometimes numeric | Auto-capitalised by the remote’s keyboard |
| Password | Another short string | A trailing space carried over from the email |
The server URL is the field people get wrong most often, because three different strings
look similar in a welcome email: the portal address, the
M3U playlist URL and the API server URL. The one the
Xtream login wants is the short one with a port on the end. It does not contain
get.php, and it does not contain your username.
Xtream login versus M3U playlist
| Xtream Codes | M3U playlist | |
|---|---|---|
| What you paste | Three short fields | One long URL |
| Contains credentials | Separately | Inside the URL |
| Best on | TV remotes, Fire Stick, set-top boxes | Desktop players, quick tests |
| Typical failure | One field copied with a space | URL truncated at the first & |
| Guide and catch-up | Supplied by the API | Usually supplied separately |
Both reach the same account. If a player offers both, choose Xtream: typing one long URL with a remote is how people end up with a half-loaded channel list and no guide.
Where your credentials come from
From the welcome email sent after the trial request or the purchase. It contains either the three Xtream fields, or a playlist URL in this shape:
http://host:8080/get.php?username=NAME&password=PASS&type=m3u_plus
If you only have that URL, the username and password are the values after
username= and password=, and the server URL is everything
before /get.php. That is how to turn a playlist link back into an Xtream
login when a player asks for the fields.
The email is the account
Anyone with those credentials can watch on your connection and use up your allowance. Keep the email, do not post the URL in a forum, and ask support to reset the login if it has been shared.
Entering the login
-
Open the player and choose the API option
TiviMate calls it “Xtream Codes API”; IPTV Smarters Pro asks you to pick between “Xtream Codes API” and “M3U URL” before the form appears.
-
Name the profile anything
The profile name is local to your device. It is not a username and it is not sent to the server — “Living room” is fine.
-
Type the three fields, then wait
Paste the server URL, then the username and password. A full list takes one to three minutes to import on a Fire Stick; pressing back restarts it. The Fire Stick guide covers the rest of the install.
What each error means
| Message | What it actually says | Fix |
|---|---|---|
| “Invalid username or password” | The server answered, and rejected the pair | Retype both by hand; check for a trailing space or autocapitalisation |
| “Connection timed out” | The server was never reached | Check the protocol and the port; try http before https |
| “Empty playlist” | Login worked, no list returned | The wrong server URL — often the portal address instead of the API |
| “403 / account in use” | Connection limit reached | Close the other device, or add a connection to the plan |
| Works on the phone, not the TV | The remote keyboard changed the case | Switch the field to plain text and retype the password |
There is a fifth case that is not an error message: the list loads and the guide stays empty. That is an EPG setting inside the player, not a login problem — the setup guide has the fix.
Questions about this
Is Xtream Codes an app I need to install?
No. Xtream Codes is a login format, not an app. You enter the three fields into a player such as TiviMate, IPTV Smarters Pro or the player built into your device. The format is named after the panel software that popularised it, which is why the same three fields appear in players that have nothing to do with that company.
Which field is the “server URL”?
It is the address of the login server, including the protocol and the port — for example http://server.example.com:8080. It is not the M3U playlist link and it does not end in get.php. If the port is missing, most players will report a connection error rather than an invalid password.
Can I use the M3U link instead of the three fields?
Yes. The M3U playlist URL contains your username and password inside it, so players that support playlists need only that one line. On a television remote it is harder to type and easier to truncate, which is why the three-field Xtream login is usually the better choice on a Fire Stick.
Why does my player say “invalid username or password” when they are correct?
In practice it is almost always a trailing space copied from the email, the username typed with autocapitalisation on a remote keyboard, or a server address with https where the server speaks http. Retype the three fields by hand before assuming the login is wrong.
Can two people use one Xtream login at the same time?
Only within your plan’s connection allowance: every plan includes one, and extras can be added at 10% off the plan price. Installing the login on several devices is fine; playing on more than your connections allow disconnects the oldest stream.
What should I do if the login leaks?
Treat it like a password, because that is what it is: anyone holding the URL can watch on your connection. Do not paste it into forums, screenshots or support chats in public. If it has been exposed, contact support and ask for the credentials to be reset.