The panel, the API, and what the credential really is
Xtream Codes and Stalker portals are two authentication models bolted onto the same job. This is the tooling, plus the protocol detail that explains why a credential fails.
- player_apiXtream endpoint
- MAC authStalker model
- 24hDataset cycle
Two authentication models
Xtream Codes
Credential-pair auth over HTTP query parameters. One origin serves the player API, the M3U handler and the XMLTV guide.
Query a panelStalker / STBemu
Device auth by MAC address. The portal maps a hardware identifier to a subscriber profile — no password anywhere in the exchange.
Query a portalWhat happens when you click
- 1
The dataset streams in
The spreadsheet is fetched with a streaming reader so download progress is real rather than simulated, then handed to a Web Worker. Parsing tens of thousands of rows never touches the main thread.
- 2
A row is drawn locally
Selection happens in your browser against the parsed rows. Region mode uses a prebuilt index of row offsets per region, so filtering is a lookup rather than a scan.
- 3
Fields uncover in sequence
Non-sensitive fields are readable and copyable as soon as they appear. Only the secret — password or MAC — is gated.
- 4
Verification goes through a proxy
A browser on HTTPS cannot call an arbitrary HTTP panel, so the check runs through a Cloudflare Worker that performs the request and reports the status back.
Protocol questions
What exactly does the Xtream API authenticate against?
Nothing stateful. Username and password travel as query parameters on every request to player_api.php — there is no token exchange and no session, so each call re-authenticates from scratch.
Why does a Stalker portal need no password?
Because the MAC address is the credential. The portal keeps a list of registered hardware identifiers and maps each to a subscriber profile, which is why a portal URL alone is useless.
Why is the check done server-side?
Mixed-content rules. An HTTPS page cannot issue requests to a plain HTTP host, and panels almost never hold a valid certificate, so the request is proxied.
Android builds
The lookups as installable apps. No browser, no mixed-content proxy — the request goes out from the device.
Sister sites
The same tooling written for two different readers. Pick whichever pitch suits what you are doing.
The endpoints listed here circulate publicly. We operate none of them, host no media, and pass no video traffic. Material is provided for protocol study, connectivity testing and player compatibility work.