The Xtream player API, endpoint by endpoint

What player_api.php, get.php and xmltv.php each return, and how a client assembles a channel list from them.

One origin, several handlers

An Xtream panel exposes a small set of PHP handlers under a single origin. The credential you hold is the origin plus a username and password; every capability is a path beneath it. A client that supports Xtream natively knows these paths and builds its requests itself, which is why you must never append a path to the server URL by hand.

player_api.php

The main handler. Called with username and password and no action, it returns a JSON object describing the account: status, expiry timestamp, the number of simultaneous connections permitted, and how many are currently active. That single response is the most informative thing you can retrieve, and it is what a verification check queries.

Adding an action parameter selects a view — live categories, live streams, VOD categories, VOD streams, series, and per-stream detail. Each returns a JSON array. A client typically fetches categories first, then streams, then builds its tree locally.

get.php

The playlist handler. Given the same credentials plus type=m3u_plus and an output format, it returns a complete M3U covering everything the account can see. This is the compatibility path: players that cannot speak the JSON API can still consume the playlist.

The cost is structure. An M3U is flat. Categories collapse, series become individual entries, and video on demand mixes into the same list as live channels. Anything with native Xtream support should use the API instead.

xmltv.php

The guide handler, returning XMLTV for whatever programme data the panel holds. In practice this is the least reliable endpoint on any panel: many are never populated, and many rate-limit it aggressively because the payload is large. An empty guide says nothing about whether the streams work.

Why the port matters

Panels are rarely on port 80. Common choices are 8080, 8000 and 25461, and the port is part of the origin — omit it and every request above goes to the wrong place. A credential that looks correct but fails immediately is very often a dropped port.