What each Xtream field actually means

Server URL, username, password, expiry and region — what the server does with each one and which ones matter.

Server URL

The base address of the Xtream panel, including its port. Everything else is a path underneath it: the player API lives at /player_api.php, the playlist at /get.php, the guide at /xmltv.php. When a player asks for "server" or "portal", this is the value it wants — the origin only, with no trailing path and no trailing slash.

The port matters more than people expect. Providers commonly run on 8080, 8000 or 25461 rather than 80, and an otherwise perfect credential fails silently if the port is missing.

Username and password

A plain credential pair, sent as query parameters on every request. There is no token exchange and no session — each call carries the username and password again. That has two practical consequences: anything that can read your URL bar can read your credentials, and a single account used from several devices at once may be cut off if the provider enforces a connection limit.

Expiry

The date the subscription behind the account ends. This is the field most people ignore and it explains most failures. A server can be perfectly healthy and still refuse an expired account, and the error it returns is the same one you get for a wrong password — so read the expiry before you conclude the credential is malformed.

Region

Where the panel is hosted, which is a rough proxy for which content it carries and how far the packets have to travel. It is not a guarantee: a panel in the Netherlands may serve mostly Arabic bouquets. Treat it as a latency hint first and a content hint second.

What is not in the credential

Nothing in an Xtream credential tells you the bitrate, the codec, whether the streams are HD, or how many simultaneous connections the account allows. Those are provider settings, discoverable only by connecting. This is why checking the server is worth the two seconds it takes.