Setting Up Xtream Codes Login

Xtream Codes login lets your users sign in to your streaming service with a username, password, and server address. If your backend supports the Xtream Codes API, this is one of the most common login methods we configure in branded apps. This article explains how it works and what to prepare.

How Xtream Codes login works

With this method, your app presents a login screen where the user enters:

A server URL (your panel address, including the port if required).
A username.
A password.

The app uses those details to authenticate against your panel and to load live channels, VOD, catch-up, and EPG that your service exposes. OTTBuilder provides the login screen and player; your panel provides the content and credentials.

OTTBuilder does not host panels, issue credentials, or supply content. Your Xtream Codes service must already be running and reachable for the login to succeed.

What to prepare

Before we configure this login method for your app, have the following ready:

The base server URL users will connect to.
Whether a specific port is required.
Whether your server uses HTTP or HTTPS.
A test account (username and password) so we can verify login and playback during the build review.

Configuration options

Depending on your service, you can choose how flexible the login screen should be:

User-entered server — Users type the full server URL themselves. Best for resellers whose users already know their server.
Pre-filled server — The server URL is locked into the app, so users only enter a username and password. This is cleaner for a single-service operator.

Pre-filling the server URL reduces support tickets dramatically. If all your users connect to the same panel, lock the server and ask only for username and password.

Testing the login

During build review, test these scenarios with your live service:

A valid account logs in and loads content.
An invalid password shows a clear error.
An expired account is handled gracefully.
Live, VOD, catch-up, and EPG all populate as expected.

If your panel sits behind a firewall, geo-restriction, or rate limiting, logins may fail intermittently during testing. Confirm your server is reachable from outside your network before review.

Security recommendations

Prefer HTTPS so credentials are not sent in plain text.
Use a dedicated test account for review and rotate it afterward.
Keep your panel software updated to reduce downtime that users would experience as login failures.

If you use playlists instead

Some operators distribute access through playlist files rather than panel credentials. If that describes your service, see Using M3U / M3U8 Playlists. You can also offer more than one login method in the same app — ask us during onboarding.

When you have your server details and a test account ready, begin at /get-started or reach out via /contact.