xtream_lookup
Xtream Codes credentials, revealed field by field. Verify before use.
What the credential addresses
An Xtream credential is an origin plus a credential pair. The origin — hostname and port — is the base for every handler on the panel: player_api.php for the JSON API, get.php for the M3U playlist, xmltv.php for the programme guide. A native client derives those paths itself, so the server URL must be the origin alone, with no path and no trailing slash.
The port is part of the origin. Panels commonly listen on 8080, 8000 or 25461 rather than 80, and dropping it sends every subsequent request somewhere that is not the panel.
How authentication works
There is no session and no token. The username and password are re-sent as query parameters on every call. Two consequences follow: anything that can read the request URL can read the credentials, and a single account driven from several devices at once will be cut off once the provisioned connection limit is reached.
Called with no action, player_api.php returns account status, the expiry timestamp, the permitted connection count and how many are currently active. That one response is the most informative thing available without opening a stream, and it is what the verification check retrieves.
Reading the verification result
The check runs through a proxy because a browser on HTTPS cannot call a plain HTTP panel. Active means the panel answered and the pair authenticated. Dead means no answer, or a rejection. Unknown means a timeout — worth exactly one retry.
None of these prove the stream will play. An authenticated account can be out of connection slots, or the panel's upstream sources can be down while the panel itself keeps answering perfectly. That is the failure mode most often mistaken for a client fault.
The four reasons a credential stops working
Expiry, which the field tells you outright. Connection limits, where authentication succeeds and streams do not open. Address rotation, where the origin stops answering entirely. Upstream failure, where everything looks healthy and the stream URLs lead nowhere. Check the expiry first because it costs nothing; past that, drawing another row is faster than diagnosing someone else's panel.