Hetspan › Guide

Xtream Codes login or M3U URL? What your provider actually sent you

Your provider has sent you something, and the app on your television is asking for something that does not look like it. The box wants a "Portal URL" and you have a username and password. Or it wants a "Playlist URL" and you have three separate values. That mismatch is a common reason a perfectly good subscription looks dead — it is the right values typed into the wrong kind of form, producing an error message that looks identical to an expired account.

Sort this out before you touch a single device setting.

The three formats, on sight

An Xtream Codes login is three separate values. It arrives looking like this:

• Server: http://example-host.com:8080
• Username: ab12cd34
• Password: 9xk4mq7z

Different providers label the first field "Server", "Server URL", "Host", "DNS" or "Portal". They all mean the same thing: the address of the panel your account lives on.

An M3U URL is one long link. It looks like this, usually on a single unbroken line:

http://example-host.com:8080/get.php?username=ab12cd34&password=9xk4mq7z&type=m3u_plus&output=ts

The giveaway is get.php in the middle. If your link contains that, you are holding a playlist address.

A MAG or stalker portal is a URL plus a request for your MAC address. Typically http://example-host.com/c/ or http://example-host.com/stalker_portal/c/, sent alongside a message asking for the address printed on your box, in the form 00:1A:79:11:22:33. If nobody asked you for a MAC address, you do not have a portal, no matter what the message called it.

The thing nobody tells you: the first two are the same account

An M3U URL is not a different product from an Xtream login. It is the same three values assembled into one line. Take the example above apart:

So if you were sent only an M3U link and your app wants an Xtream login, read the three values straight out of the link. If you were sent only an Xtream login and your app wants a playlist URL, build the link yourself in a text editor by substituting your own host, port, username and password into the pattern above. Knowing that one thing is usually enough to resolve a format mismatch on your own, without a support message.

Notice what else the table shows: your password is written out in full inside that link, so anyone holding the link holds your subscription. Keep it as private as the password itself — there is a short list of what is safe to send support further down this page.

It also means the format you were sent barely matters. Any Xtream-compatible provider issues the same values in the same shape, so a guide written for one works for all of them.

The port is not optional

The number after the colon is part of the address. Panels rarely sit on port 80, so http://example-host.com and http://example-host.com:8080 are two different destinations, and only one of them exists. Leave the port out and the app cannot reach the panel — but the message it shows you is often "invalid username or password", which sends people off chasing a credential problem that isn't there.

Four more things that quietly break this field:

• http:// and https:// are separate endpoints. If your provider specified one, use that one. Swapping them can produce an authentication error rather than an obvious connection failure.
• No trailing slash, and never /c/ on the end of an Xtream server address. That suffix belongs to portals.
• If your chat app wrapped the address onto two lines, copying it can insert a space or a line break. Paste it somewhere plain and check it is one continuous string.
• Phone and TV keyboards autocapitalise the first letter of a field. Usernames and passwords are case-sensitive, so Ab12cd34 is simply a different account from ab12cd34.

The EPG address

The programme guide comes from a separate file on the same server, usually http://example-host.com:8080/xmltv.php?username=ab12cd34&password=9xk4mq7z — same host, same port, same credentials, different endpoint.

Apps that take an Xtream login normally fetch this by themselves and never ask. Apps fed a plain M3U often need it typed in separately. The practical consequence: if your channels play but the guide is empty, the fault is the EPG address or the app's guide settings, not your subscription. Channels and guide are fetched independently and one can work while the other doesn't.

output=ts versus output=m3u8

That last parameter controls how the stream is delivered. ts gives you a direct MPEG transport stream. m3u8 gives you HLS, where the stream is cut into short segments the player fetches in sequence.

Some players handle one better than the other. A list that loads perfectly but stalls the moment you press play is worth retesting with the other value swapped into the URL — it is a client compatibility difference, not a quality setting, and neither one is "the HD version".

Which apps want which

Once you know which you have, go to the guide for your hardware: Fire TV Stick and Android TV, MAG box, or Samsung and LG smart TVs.

Prove the credentials before you blame the device

Do this on a phone or laptop before you spend an evening in TV menus. Paste your M3U URL into a normal web browser, exactly as it was sent to you, including http:// and the port. One of three things happens:

1. A file downloads, or a page of text full of #EXTINF lines appears. The account is alive and reachable, and whatever is wrong is on the device.
2. You get an authorisation error or an empty response. The credentials, the port or the connection limit is the problem.
3. Nothing loads at all. Network or DNS — try mobile data instead of your home connection to see if that changes anything.

One modern trap before you read too much into a failure. Browsers now reach for HTTPS first: paste a plain http:// address and the browser may rewrite it to https://, put a security interstitial in front of it, or refuse outright. A panel that only answers on plain HTTP then looks dead when it is perfectly alive. If the address in the bar changes to https://, or you get a warning page instead of a download, that is the browser and not your account. Run the same test in VLC instead — Media > Open Network Stream, paste the same URL. VLC uses the address you give it rather than upgrading it, and it also shows you whether the streams themselves play on a machine that is definitely capable.

A formatting slip and an account that was never switched on produce the same message inside an app, which is exactly why this two-minute test is worth running before you conclude anything. If it genuinely fails, that is the moment to message your provider's WhatsApp support rather than the moment to reinstall the app for the fourth time.

What to send support, and what never to send

Your password is the one value that has to stay yours. Anyone holding it holds your subscription, and a password typed into a chat stays in that chat.

• Safe to send: your username, the server address and port, the order or payment reference you were given, the name and version of the app, the device you are using, and the exact wording of the error on screen. That is enough for any provider to find your account.
• Never send your password — not typed out, not in a photo of the television, not in a screenshot of the app's settings page. No provider needs it to check, extend or repair your account, and anyone who asks for it should not be given it.
• Treat your M3U URL as a password too. The password= parameter is part of the link, so posting it on a forum, in a review, under a video or in a group chat gives your subscription away. Sending it to your own provider's support is fine, because they issued it. Anywhere else is not.
• If a password or a full M3U link has already gone somewhere it should not have, ask your provider to reset the credentials rather than hoping.

One connection means one screen

Subscriptions are sold with a set number of simultaneous connections. Check how many yours includes; if it is one, the following applies, and it is routinely mistaken for an unstable service.

• A second device signing in can knock the first one off mid-programme.
• A device that was unplugged or force-closed rather than exited cleanly can go on holding the slot until the server times the stale session out, so your "only" device is competing with its own ghost.
• Playing a stream in VLC uses a slot for as long as it plays, so close it when you are finished. Downloading the playlist in a browser does not: fetching get.php is a single request that returns a text file and then ends, while the connection counter tracks open stream sessions. The browser test above is safe to run while the television is playing.

If it worked yesterday and is dead today, close every other player first and give any stale sessions time to drop before concluding anything.

Error messages, translated

• "Invalid username or password" with details you know are right — missing port, wrong protocol, a capital letter the keyboard added, or a space picked up in a copy-paste.
• "Connection timed out" — network or DNS. The app never reached the server, so the credentials were never even judged.
• "Account expired" — the server answered, and it answered clearly. That is a matter for your provider, not for the app.
• "Max connections reached" — another session is live. See the section above.
• Groups and channels load, then nothing plays — the account is fine. Look at the player, the stream output format, or your connection speed; the device guides cover this.