Signing in with Xtream Codes for your Xbox

If your provider handed you a username, a password and a host, you have Xtream credentials. Use them rather than the M3U export the same provider will also happily give you. The export is a snapshot. The portal is a conversation, and three things fall out of that difference.

Where the credentials go#

Not on the console. The Xbox has no field for a host, a username or a password, and the sources screen there says what it is: read-only, synced from the web console.

Open the web console, go to Sources, add an Xtream source, and give it the three values your provider sent you. They usually arrive looking like this:

Host      http://line.example.com:8080
Username  h7d2kq
Password  4mZp91xr

Save it. The console picks the source up on its next sync and you never type any of that on a controller.

There is a security reason to prefer this direction as well as an ergonomic one. Credentials entered in a browser go into your account once. Credentials typed on a shared living-room screen are typed in front of whoever is in the room.

What the portal gives you that a file cannot#

A playlist export is a list of URLs frozen at the moment it was generated. A portal answers questions, and the client asks it several. The whole panel API is one script taking an action parameter, and 15 actions cover everything below.

The first is the catalogue itself, categories included, which is what lets the console show you 444 provider groups instead of one flat wall of channels. The second is the archive: a portal can say which channels keep a rewindable window and how many days deep it goes, which is the whole basis of catch-up. See what catch-up and timeshift actually are.

The third is the one people discover the hard way. A portal reports how many simultaneous connections your line allows. Most are 1 or 2. That number is not decoration: it is why a channel that plays on the Xbox refuses to play on the laptop at the same time, and why multiview is careful with it.

Multiview counts that budget before it assigns a tile, not after. Ask for a 3x3 grid of 9 tiles against a line that allows 2 connections and the picker stops offering channels from that source once the second one is spoken for, rather than starting 9 streams and letting the portal reject 7 of them. That is a deliberate choice about where the failure happens. Connection limits goes through the accounting in detail.

The stream format setting#

An Xtream source has a Stream format control. It currently changes nothing. It normalizes its value, saves it and reloads it, and no URL builder and no playback code reads it back.

Whatever it is set to, the client asks for a live URL ending in .ts:

http://line.example.com:8080/h7d2kq/4mZp91xr/12345.ts

That is what we request, not what a portal returns. A portal is free to redirect that request to an HLS manifest, and some do; the client does not probe for it. MPEG-TS or HLS has the argument and the measurements.

What is not on the console yet#

Catch-up is the honest gap. It shipped on the desktop head first, and the console page for it is still outstanding work. So an Xtream portal that offers a 7 day archive gives you that archive in the Windows app today, and on the Xbox you get live channels and the schedule without the rewind.

The schedule itself is there. On the console it lives inside Live TV rather than as a separate destination: open a channel, bring up the schedule layer, and the bumpers move you a day at a time. The standalone Guide screen in the app navigation is still a placeholder.

Being specific about that beats the alternative. An article that implied full catch-up parity would cost you an evening of looking for a button that is not there. Catch-up TV on Xbox says what works today and what is coming.

If the portal will not connect#

Two causes account for most of it, and neither is usually the portal.

The first is that the credentials are right but the line is at its connection limit, because something else is still holding it. Portals do not always time out a dropped session immediately.

The second one took us a while to recognise, because everything else about the machine worked. Some security suites block requests to a portal's API endpoint specifically because the username and password sit in the query string, which looks exactly like credential leakage to a heuristic. Streams keep playing, because those are a different URL shape, and the login call is the only thing that fails. If logins fail on one machine and work on another on the same network, suspect the local security product before the provider. A playlist that will not load walks the rest.