Xtream Credentials Explained: Server, Username and Password

In many Xtream-compatible IPTV players, login details take the form of three fields: a server address, a username, and a password. These values collectively identify where the service is hosted and authenticate the account that has access to it. Not all IPTV services use this format — but for those that do, understanding what each field means makes it easier to enter them correctly and protect them appropriately.

What Are Xtream Credentials?

Xtream credentials are the three pieces of login information that identify a user account on an Xtream-compatible server: the server address, the username, and the password. The term refers to the login details — not to the Xtream-style API convention itself. A user can hold valid credentials without knowing anything about the API, and a developer can understand the API without access to any particular user's credentials.

What the Server Address Means

The server address tells the player where to make its connection. It typically includes the scheme, the host, and in many cases a port number — for example, https://HOST:PORT. The scheme (http or https) specifies whether the connection is encrypted. The host is the domain name or IP address of the provider's server. A port number, when present, indicates which network port to use; when one is omitted, the player typically falls back to the default for the scheme (80 for HTTP, 443 for HTTPS). Providers configure their own ports — there is no universal standard port for Xtream-compatible services. Use exactly the server address your provider supplies, including any port number.

What the Username and Password Do

In many Xtream-compatible implementations, the username and password are commonly included in API requests made to the server. The server uses them to confirm that the account exists and is authorised to receive content. This authentication operates at the API level and is specific to the provider's implementation — it is not necessarily the same mechanism as logging into a website. Entering an incorrect username or password typically results in an authentication failure, which players usually surface as a login or connection error.

How the Player Uses the Three Values

When you save Xtream credentials in a compatible player, the player uses all three values to connect to the server. In many Xtream-compatible implementations, an initial request commonly retrieves account and server information — confirming whether the account is active and what options are available. The player can then make further requests to retrieve categories, live channels, VOD content, series, or programme guide data, depending on what the server supports. The exact sequence of requests and the data available vary between service implementations.

Why the Same Credentials May Work in One Player but Not Another

Valid credentials can behave differently across players. Common reasons include:

• URL formatting differences — some players add a trailing slash or handle the port differently from others.
• Scheme mismatch — one player may use HTTP while the server expects HTTPS, or vice versa.
• The account has reached its maximum number of simultaneous connections because another session is already active.
• The player's implementation differs from how the server handles the Xtream-style API, causing parsing or compatibility issues.
• A whitespace character or typo was introduced when entering the credentials in one player but not another.
• The account has expired or is inactive — some players surface this as a generic connection error rather than an account message.

When credentials work in one player and not another, the issue is often how the player formats or sends the credentials rather than the credentials themselves.

How to Protect Xtream Credentials

Xtream credentials grant access to an account on a specific server. Treat them accordingly:

• Do not post credentials publicly — not in forums, support threads, or screenshots.
• Do not enter them into websites or third-party tools you do not trust, even to verify whether they are valid.
• Prefer a provider that offers an HTTPS server address where available. HTTPS protects credentials while they are in transit, but does not make them safe to publish or share — credentials embedded in URLs may still be exposed through server logs, browser history, screenshots, or copied links.
• Be aware that in many Xtream-compatible implementations, credentials appear embedded inside playlist URLs and individual stream URLs — sharing those URLs is equivalent to sharing your username and password.
• If you believe credentials have been compromised, contact your provider to have them reset.