The three ways IPTV apps log in
Almost every IPTV service gives you one of three kinds of login. Knowing which one you have saves most setup mistakes.
| Login type | What you receive | How the app uses it | Common on |
|---|---|---|---|
| Xtream Codes (API) | Server address, username, password | Asks the server for categories, channels, films, series and the TV guide separately | IPTV Smarters, TiviMate, most modern players |
| M3U playlist | One long web address ending in a playlist | Downloads the full channel list in one file | Smart TV players, VLC, Kodi |
| MAC portal (Stalker) | A portal address; the provider registers your device’s MAC address | The device identifies itself by its MAC address | MAG boxes, StbEmu, Formuler |
The Xtream Codes login is the most common today because it’s the easiest to type and keeps apps quick. If your provider sent you all three, use the Xtream Codes login unless your app or device only supports one of the others. Our guide to M3U playlists explains the playlist option in detail.
What the server, username and password do
- The server address tells the app which computer to talk to. It usually starts with
http://orhttps://and often ends with a port number such as:8080. A missing port or an extra space is the most common reason a login fails. - The username and password identify your account. They’re case-sensitive, so a capital letter typed in lower case is enough to cause “invalid credentials”.
Once you’re signed in, the app requests each part of the service separately: live channel categories, the channels in each category, the film and series libraries and the TV guide. That’s why a broken TV guide doesn’t usually stop live channels from playing. The Xtream Codes API explained lists each of those requests. Our step-by-step login guide shows exactly where each part goes in the popular apps.
What happened to Xtream Codes in 2019
On 18 September 2019, a police operation led by Italy’s Guardia di Finanza, with Eurojust and Europol, took the Xtream Codes platform offline, and servers were seized in several European countries. Services built on the platform stopped overnight, which is why many people remember that date.
The story didn’t end there. In June 2022, TorrentFreak reported that the company had been declared lawful by an Italian court and that assets seized in the raid had been returned. Meanwhile the login format and API had carried on, because other server software uses the same design. When an app offers an “Xtream Codes” option today, it means that format, not the original company. The sources are listed at the end of this page.