What Is Xtream Codes — and Why It Matters for IPTV in 2026

The welcome email from any IPTV provider sends you one of three credential bundles. A long M3U URL. A short M3U URL plus an XMLTV URL. A server URL with a username and password labelled "Xtream Codes". The third one is the modern standard, even when providers do not call it that. Understanding what it is explains why some setups work in five seconds and others take an hour.

This article walks through the history, the protocol, the differences against M3U and MAC portal, and what to do when a player asks you which one you have.

The original Xtream Codes panel

Xtream Codes started in 2014 as a panel software for IPTV operators. The panel ran on a Linux server, accepted M3U playlists and EPG feeds from upstream sources, deduplicated channels, transcoded streams where necessary, managed user accounts, and exposed a clean API to IPTV players. Subscribers logged in with a username and password; the panel handled everything else.

It became the dominant software for IPTV providers within two years. By 2018, conservative estimates suggested 50 to 70 percent of the global IPTV ecosystem ran on Xtream Codes panels. The convenience for operators was the volume effect: every IPTV player on the market supported the panel's API natively, so any provider could spin up a panel and instantly be compatible with TiviMate, IPTV Smarters Pro, IBO Player Pro and the rest.

In September 2019 the Italian Guardia di Finanza, working with Europol, seized the Xtream Codes infrastructure across multiple European countries. The arrests targeted the operators and the panel-as-a-service business. The protocol itself, though — the API that players spoke to the panel — could not be seized. It was already public, already implemented in every player, already running on thousands of independent installations. The seizure took out one operator but did not retire the standard.

The forks and the open API

Within months of the 2019 seizure, multiple forks of the Xtream Codes panel software circulated openly. The forks kept the same API surface that players already supported. From a player's perspective nothing changed: the same URL, username and password worked the same way against any fork.

By 2021 the term "Xtream Codes" had drifted from referring to the original company to referring to the API standard itself, the same way "Hoover" drifted from a brand to a generic term for vacuum cleaner. When an IPTV provider today says "we support Xtream Codes login", they mean the panel API standard, not the 2014 company.

The API standard does two main things.

A player.json endpoint returns the channel list, the category list, the live EPG and the movie/series catalogue, all in one JSON response. Players use this to populate the channel grid.

A streaming URL pattern (typically /live/USERNAME/PASSWORD/CHANNEL_ID.m3u8 or .ts) lets the player fetch the actual video stream for any channel by ID, with credentials in the URL itself.

Together those two endpoints replace the older M3U-plus-XMLTV combination with a single login. Players load the entire grid in one round trip and get the EPG, categories, channel logos and series metadata in the same response.

M3U vs Xtream Codes vs MAC portal

Three credential formats coexist in 2026 and you will encounter all of them depending on the provider and the player.

M3U. A flat text file listing every channel as a URL. The file format dates to the 1990s and the WinAmp era. An IPTV M3U has tens of thousands of entries, each with a channel name, logo URL, group title and stream URL. Players that "support M3U" download the file once and play any URL inside it. EPG is separate — usually an XMLTV URL the player must be told about separately. Pro: works in every player ever made. Con: no live API, so the channel list is only as fresh as your last download, and the EPG and the playlist can fall out of sync.

Xtream Codes. The API-based login described above. Server URL plus username and password. Pro: single login loads channels and EPG in one shot, the playlist updates live, no separate XMLTV configuration. Con: no offline mode — the player needs to reach the server to do anything.

MAC portal (also called STB Emulator login). The TV box authenticates by MAC address rather than username. The provider whitelists the MAC in their portal and the player uses no credentials at all — the MAC is the identity. Common on older Linux-based set-top boxes (Mag boxes, Formuler), still used by IBO Player Pro on smart TVs, and historically the standard on the original STB Emulator app. Pro: no password to leak. Con: tied to one physical device; changing the device or factory-resetting it requires re-activation.

The hierarchy: Xtream Codes is the default for modern installs on Fire TV, Android TV, Apple TV, iOS and Android phones. M3U is the fallback when a player is too old to speak Xtream, or when a provider has not built the API. MAC portal is the standard on smart-TV apps like IBO Player Pro and on dedicated set-top boxes.

A serious IPTV provider ships all three, so any device works.

Why Xtream is the default in 2026

Three reasons the Xtream API beat the alternatives for any new install.

The EPG is real-time. M3U requires you to wire up a separate XMLTV URL and configure refresh intervals; Xtream serves the EPG from the same API call that loads the channel list. New channels show up in the player the moment the provider adds them to the panel. Renames update on the next refresh. M3U requires the entire playlist to be re-downloaded.

Series and movies have rich metadata. Xtream's API has separate endpoints for live, VOD and series, with cover art, descriptions, runtime, year and IMDb ratings. M3U has none of this — every entry is just a URL with a name.

Authentication is per-request. Every stream URL carries the username and password as path components. The provider can revoke access at any moment by invalidating the credential; the M3U model relies on the player not redistributing the file.

For new installs in 2026 the workflow is uniformly Xtream. M3U lingers as the fallback, MAC stays on the smart-TV path.

How to recognise what your provider sent you

Open the welcome email. Look at the credential block.

If it has Server URL, Username, Password — that is Xtream Codes. Type these into your player's "Xtream Codes login" or "Portal login" screen.

If it has a single very long URL containing "get.php?username=" or "playlist.m3u" — that is the M3U URL. Type it into the player's "M3U URL" or "Add playlist" screen. If a separate "XMLTV URL" was also provided, paste that into the EPG settings.

If it has a Portal URL plus a MAC field — that is the MAC portal setup, primarily for IBO Player Pro, STB Emulator and dedicated Mag/Formuler boxes. The MAC comes from the TV or box itself, not from the provider.

Most providers send the Xtream credentials by default and include the M3U URL as a fallback for older players. Vivimate's welcome email sends both, plus the MAC portal activation URL for the smart-TV case.

What changes in 2026

The Xtream API is now ten years old. The protocol is stable, the implementations are well-tested, and players have built their entire UI around its data model. The realistic alternatives — DASH-based streaming with token authentication, HLS with signed cookies, fully custom REST APIs — are slowly appearing on the operator side but no major IPTV player supports them yet.

Practically: the next year or two of IPTV remains an Xtream world. If you are picking a provider, support for Xtream Codes login is table stakes. If a provider only offers M3U, the EPG quality and the channel-list freshness will be a notch behind.

The slow change worth watching is HEVC and AV1 codec support. The Xtream API does not constrain codec; the streams it points to can be H.264, H.265 or AV1. As more IPTV providers move to H.265 ten-bit for 4K sport, the player matters more than the protocol. A player that handles HEVC ten-bit well (TiviMate, IPTV Smarters Pro on modern hardware) will look noticeably better than one that does not (some older smart-TV apps).

The security implication

Xtream credentials live in the player on your device. The username and password are sent on every stream request, embedded in the URL. If someone scrapes a player's storage they get the live credentials. On a household device behind your home Wi-Fi this is not a meaningful threat. On a public device — a Fire TV Stick you take to an Airbnb, an old phone you sell — wipe the player first or do a factory reset before disposing.

If a provider issues you credentials they cannot rotate, that is a bad provider. Any decent provider has a "regenerate password" function in the customer portal. Vivimate's portal supports this; rotated credentials propagate to the player on the next stream request, no manual reconfiguration.

Xtream Codes is the protocol that makes modern IPTV work. Whether the welcome email says so or not, the login you typed into TiviMate is almost certainly an Xtream login, the channel list comes from the Xtream API, and the EPG you see is the JSON response from the same endpoint. The 2019 seizure of the original company is part of the history; the standard outlived it. Pick a provider that supports it, pick a player that speaks it cleanly, and the entire setup compresses into thirty seconds of typing.