How to Set Up Xtream Codes Login for World Cup Streaming

If your IPTV subscription comes with three fields — a host URL, a username, and a password — then your provider exposes the Xtream Codes panel API, and it's the cleanest way to feed your subscription into a player. With Xtream, you get the live channel list, the EPG, the VOD catalogue, and the series catalogue all out of one login. For the FIFA World Cup 2026, that means one paste-in and the player has every broadcaster channel your subscription includes — sorted, with the program guide live.

This guide is the no-nonsense walkthrough: what each field is, how to spot the four mistakes 90% of new users make, how to test the login before kickoff, and how to recover when something fails on match day. Tournament starts June 11; the final is July 19. Plenty of time to get the credentials right.

What Xtream Codes actually is

"Xtream Codes" is the de-facto API standard for IPTV provider panels — originally the brand name of a panel/billing platform widely deployed in the mid-2010s. The platform itself went offline in 2019 after legal action, but its HTTP API surface was so widely adopted that almost every IPTV panel since (XUI.one, OttRun, Stalker hybrids, custom panels) implements the same endpoints. So when your provider says "we support Xtream Codes login," they mean their backend speaks this API.

The API uses three URL paths your player will hit:

• /player_api.php?username=...&password=...&action=... — JSON endpoints for channel/category lists, EPG, VOD, series.
• /get.php?username=...&password=...&type=m3u_plus — the M3U playlist (essentially the same channel list as the JSON API, but in M3U format for legacy players).
• /xmltv.php?username=...&password=... — the XMLTV-format EPG dump.

Your three login fields therefore map to:

Tuneline (and most modern IPTV players) hit those endpoints under the hood the moment you save the credentials.

The four mistakes that cause 90% of "login failed" errors

If your Xtream login fails, the cause is almost always one of these four:

1. The host has a path on it

Your provider's panel URL might look like http://line.example-iptv.tv:8080/c/. The /c/ is the panel's customer-facing web UI, not the API base. The API lives at the root.

• Wrong: http://line.example-iptv.tv:8080/c/
• Wrong: http://line.example-iptv.tv:8080/player_api.php
• Right: http://line.example-iptv.tv:8080

Strip everything after the port. If there's no port, strip everything after the hostname.

2. The port is missing

Most IPTV panels run on a non-standard port (8080, 8000, 25461, 8585, 25461 are common). If you only paste http://line.example-iptv.tv, the player tries port 80 (or 443 for HTTPS), gets nothing, and returns a generic failure.

If your provider gave you a URL without a port, try the common ones — 8080 first, then 25461. Or check whatever URL appears in the subscription email they sent: the port is usually right there.

3. HTTPS vs HTTP

Some panels serve over HTTPS with a valid certificate. Others only run HTTP. A surprising number have a self-signed or expired cert that breaks HTTPS clients. If your provider's link is http://..., use HTTP — don't "upgrade" it to HTTPS hoping it'll be more secure. The certificate failure looks identical to a wrong-password failure from the player's perspective.

If the host you were given is https://, leave it; the cert is likely valid.

4. Trailing slash

Old-school panels are picky. http://line.example-iptv.tv:8080/ (with trailing slash) sometimes 404s where http://line.example-iptv.tv:8080 (no slash) works. Some panels are the reverse. If your first attempt fails on a host you're confident is right, toggle the trailing slash and retry.

Step-by-step: setting up Xtream Codes for the tournament

1. Find your three fields

They come from your provider — usually in the subscription confirmation email, sometimes from a "panel" page on their website. Look for "Xtream Codes login," "API credentials," or a section with three labelled fields. Your provider might give you a URL like http://example.tv:8080/c/?username=john&password=XYZ — the part before /c/ is the host; username= and password= are obvious.

If you can't find them, an M3U URL works just as well — see how to add an M3U playlist step by step. M3U is a single URL with credentials baked in; Xtream is three fields. Functionally close for live TV; Xtream gives you VOD and series catalogues too.

2. Paste them into the player

Open Tuneline → source selector → Add Playlist → choose Xtream Codes. Paste:

• Host: the URL with port, no trailing path. Example: http://line.example-iptv.tv:8080
• Username: as provided.
• Password: as provided.

Hit Save.

3. Confirm channels load

If the login worked, the channel list populates within 10–30 seconds for a typical provider (5–15,000 channels). Live TV, VOD movies, and VOD series all appear as separate tabs in the sidebar.

If you see a generic "login failed" or "could not connect" error, walk through the four mistakes above before doing anything else.

4. Confirm the EPG loads

In Tuneline, switch to the EPG view (or open the channel info panel on any channel). If you see programme entries with start times, the XMLTV feed is working. If the guide is blank or stuck on yesterday, see EPG not loading fix. Most Xtream panels expose the guide automatically; some require you to manually paste the XMLTV URL into Settings → EPG → Custom guide URL.

5. Pre-test a stream before kickoff

Pick any sports or HD channel and play it for two minutes. If it plays smoothly, your Xtream login is fully functional — the credentials work, the panel is reachable, the streams route correctly. If the channel list loads but no stream plays, the panel allows API calls but is blocking media delivery (less common; usually a provider-side network issue).

Verifying the credentials with a browser (optional debug)

If the player keeps failing and you're not sure why, open this URL in a browser (replace the three fields):

http://YOUR_HOST:PORT/player_api.php?username=YOUR_USERNAME&password=YOUR_PASSWORD

What you should see: a JSON blob starting with {"user_info":{...},"server_info":{...}}. That confirms the panel is reachable and the credentials are accepted.

What you might see instead, and what each means:

• HTTP 401 or empty {} — username/password rejected. Double-check casing (passwords are case-sensitive) and look for accidental spaces.
• HTTP 404 — wrong host or wrong path. Strip any path after the port.
• HTTP 503 / connection refused — wrong port or panel offline. Try common ports (8080, 8000, 25461).
• Browser says "site can't be reached" — DNS or host typo. Confirm the host resolves with ping or nslookup.
• Cert error in browser — HTTPS cert issue. Switch to HTTP if your provider allows it.

If player_api.php returns valid JSON in the browser but the player still fails, the issue is on the player side — copy the host/username/password into Tuneline again, paying extra attention to whitespace.

Xtream Codes vs M3U vs Stalker — pick the right format for the tournament

For more on the differences see M3U vs Xtream Codes vs Stalker Portal.

For the FIFA World Cup 2026 specifically, Xtream is the recommended format if your provider offers it, because:

1. The EPG is delivered automatically — match times show up in your guide without a separate URL paste.
2. Sports VOD catalogues (post-match highlights, condensed broadcasts) are accessible from the same login.
3. Category sorting is richer — most providers tag a "Sports" or "Sports HD" category that filters cleanly during the tournament.

What to do on match day if the login suddenly fails

A small number of provider-side things can break a working Xtream setup mid-tournament:

• Provider rotates the host. Some providers shift you to a new host once an old one starts taking abuse traffic. They'll email you the new host. Just update the host field in Tuneline → source selector → edit playlist.
• Provider expires the credentials. Either your subscription has lapsed (renew it), or they've reissued credentials for security (the email will say so).
• Provider throttles or blocks during peak load. Mid-final lag is common. Either wait it out or try a different IPTV provider as a backup. Some users keep two subscriptions during the tournament for redundancy — premium-tier providers tolerate this.
• Local DNS issue. If you can ping 1.1.1.1 but not your provider's host, your ISP DNS is failing the lookup. Switch to Cloudflare DNS (1.1.1.1) on the router or the device.

For all of these, the recovery is fast (under five minutes if you know what to change). The cost of not knowing is missing the match. Test your setup the week before kickoff so you've already seen what the screens look like.

Frequently asked questions

What is Xtream Codes login?

It's the three-field credential format used by most IPTV panel platforms — host URL, username, password. The three fields let a player hit the panel API to fetch the channel list, EPG, VOD, and series catalogues automatically.

Why does my Xtream login keep failing?

Almost always one of: wrong host (path included, port missing, HTTP vs HTTPS), wrong port, trailing slash, or case-sensitive password. The "Four mistakes" section above covers each. Verify with the browser URL test before assuming the credentials are bad.

What's the difference between an M3U URL and an Xtream Codes login?

An M3U URL is a single URL — credentials baked in — that returns just the live channel list. Xtream Codes is three fields and returns live + VOD + series + EPG. If your provider gives you both, prefer Xtream for a richer feature set.

Is Xtream Codes legal?

The protocol itself is just an HTTP API — there's nothing illegal about a player implementing it. What matters is whether the provider you're subscribed to holds rights to the channels they distribute. Tuneline is a media player; the legality of the source is your responsibility.

Will Xtream work on every Tuneline device?

Yes. Tuneline's Xtream support is the same across Mac, Windows, Linux, Android, Google TV, and Fire TV. Set up once, sync across the rest via cross-device sync.

Does Xtream Codes support recording for the tournament?

Recording is a player feature, not an Xtream feature. Tuneline's DVR works against any source — Xtream, M3U, or Stalker — on Windows, Linux, and Android. (How to record live TV.)

What if my provider gives me four fields instead of three?

You're likely seeing host split into "host" + "port" as separate fields. Combine them as http://host:port for the Tuneline host field. If the fourth field is "MAC address," that's actually a Stalker portal in disguise — set it up as Stalker instead.

The short answer

Your three fields paste into one screen. The host has no trailing path, no missing port, and (usually) HTTP. Verify with a browser by hitting player_api.php directly. Pre-test a stream a week before kickoff and have your provider's email open in case a host rotates mid-tournament. With the setup right, every match your subscription covers — broadcast schedule and EPG included — is one click away in Tuneline.

For the full pre-tournament checklist see the cornerstone World Cup IPTV player guide. For country-specific setup: USA, UK, Canada. For format-level background: M3U vs Xtream Codes vs Stalker Portal. For when something breaks mid-match: how to fix IPTV buffering, black screen but audio works fix, Xtream Codes login failed fix.