Before you begin
- Any player offering an Xtream, Xtream Codes or API login option
- The activation message containing your three values
- Somewhere to keep them that is not a chat thread
Nothing to sign in with yet? Take a 24-hour trial and keep every subscription you have while you check what this covers, or see what it costs first.
Getting it running
Know what each of the three does
The address names the machine holding your line. The username identifies your account on it. The password proves the account is yours. That is genuinely all of it — there is no portal to log into, no email confirmation and no second factor, which is exactly why those three values together amount to the subscription itself and deserve the care you would give a password.
Find the option, whatever your player calls it
Smarters says Login with Xtream Codes API. TiViMate says Xtream Codes login. Others shorten it to Xtream, or simply API. Wherever a player offers this alongside a playlist option, take this one — it brings the guide and the catalogue with it, and the playlist route frequently brings neither.
Understand what each value actually does
The server address says which machine holds your line. The username identifies the account on it. The password proves it is yours. That is the whole of it — there is no account portal, no email confirmation and no second factor, which is why the three values together are effectively the subscription and should be treated as you would treat a password.
Get the address right, because this is the one that fails
It wants the protocol at the front and the port at the end, in the shape http://example.com:8080, with nothing following the port. If a login is refused and you can only check one field, check this one. Across every platform on this site, it is responsible for more failures than the other two combined.
Enter the name and password exactly
Both are case sensitive, so capitals matter. The profile label is decorative and affects nothing. If you paste rather than type, be aware that a trailing space travels invisibly and will produce a rejection indistinguishable from a wrong password — retyping by hand once settles the question either way.
Save, and let the first sync finish
Channels, catalogue and guide download themselves over a minute or two. Do not form a view during that window; a half-populated app and a broken one look identical, and a fair number of first impressions are formed thirty seconds too early.
Then reuse the same three everywhere
This is the practical payoff. The lounge television, a bedroom set, a laptop and two phones all take the identical values, each in under two minutes. Your tier governs how many play at once rather than how many are configured, so there is no reason to leave a screen out — and a household testing this on one television only is judging it against subscriptions that are on every device they own.
When something misbehaves
The player only offers a playlist field
Some older software never learned this format. Use the M3U link from the same message, which wraps the same account differently; the playlist page explains what changes when you do. Where both options exist, there is no reason to choose the playlist.
Everything looks right and it still refuses
Type all three by hand, once, slowly. Copying from a messaging app brings trailing whitespace along more often than anyone expects, and nothing on screen will reveal it. If a careful manual entry is still refused, that is the point at which asking us whether the line is active becomes worthwhile.
It worked last week and does not today
Check the expiry before anything else, because a plan reaching its end produces precisely this and needs nothing reinstalled. Renewing restores the identical values within minutes and your favourites survive untouched.
One device keeps being dropped
That is the simultaneous-screen limit behaving correctly, and it reads convincingly as a fault. Count what is genuinely playing — including a phone somebody left running in another room — before concluding anything is broken.
The app asks for a port separately from the address
A few players split them into two fields. Put the domain or IP in one and the number after the colon in the other, without http:// where the field is labelled host rather than URL. Where a player wants the whole thing in one box, include the protocol and the port together as sent.
Other players the same login opens
IPTV Smarters Pro
Install IPTV Smarters Pro on Firestick, Android, Samsung, LG, Apple TV or PC, sign in with Xtream Codes and load the guide. Free, 25,000+ channels.
TiViMate
Set up TiViMate on Android TV, Firestick or an Android box with your Xtream login, load the guide, and see what Premium adds. 25,000+ channels.
All of them
Every device and player covered, on a single page.
See what it covers on your Xtream Codes login
A trial costs nothing and runs alongside everything you already subscribe to, so you can work out what would genuinely go and what you would keep. Plans open at $15 a month for the full 25,000+ line-up.
What people ask about the Xtream Codes login
Is the format itself legal?
It is a convention for passing an address, a name and a password, and apps in every mainstream store use it. There is nothing restricted about it whatsoever. The question with legal weight is whether a given service holds rights to what it distributes, which is about companies rather than about formats, and our legality article deals with it properly.
Can I change my password?
Ask support and a new one is issued. Worth doing if the credentials were ever shared outside the household, because whoever holds those three values holds the subscription and there is no second factor standing behind them.
Does the same login work with another provider?
It works in any player that speaks the format, which is nearly all of them — that portability is about software, not suppliers. It will not work against somebody else's service, because the credentials are ours. The useful consequence is that changing supplier later costs you no apps and no setup.
What happens to my details if I stop?
The line ends with the paid term and the values stop working. Records are held for twelve months so that a return can keep the same credentials, then deleted. The privacy page sets out the full schedule, including how to have them removed sooner.
Why not just use an email and password like a normal service?
Because this format predates the current generation of players and every one of them already speaks it, which is exactly what makes a single account configure a Samsung, an Android box and an iPhone without any of them knowing about the others. The trade-off is the absence of an account portal, and it is a real one.
Can two people use the same login in different houses?
Technically the credentials would work; practically the simultaneous-screen limit makes it obvious very quickly, and the terms treat one line as one household. Accounts found shared beyond that are closed without refund. The two-screen tier costs less than most single platform subscriptions if two households genuinely want to split something.
Do I need to understand any of this to use the service?
No, and most subscribers never think about it again after the first evening. It is worth three minutes for exactly one reason: when a second television refuses to sign in six months from now, knowing which of the three values is likely wrong turns a support message into a ten-second fix. The server address is nearly always the answer.
Where should I keep the credentials?
A password manager if you use one, or a note on a phone if you do not. Anywhere except only in a chat thread, which is where they will be buried under several hundred messages precisely when you need them. Adding a device takes under a minute with them to hand and a support exchange without.