Complete Guide for Authenticating ActiveCode Users with the Player API
When using ActiveCode subscriptions, the mac (Device ID) parameter is REQUIRED on ALL URLs, not just API endpoints.
This includes:
If appname is configured, it must also be included in ALL URLs consistently.
The Device ID is a unique identifier that provides the first layer of security for your ActiveCode authentication. Think of it as a digital fingerprint for each device using your service.
The Application Lock provides an additional optional security layer by binding the ActiveCode to a specific application. This ensures that even if someone has the correct Device ID and ActiveCode, they can only access streams through your authorized application.
appname parameter to ALL API calls and URLsForget about complex API integration, decryption functions, and endless testing. Get your 2-in-1 ActiveCode Ready App customized for your panel!
Fully functional apps for both platforms
All endpoints already configured with proper authentication
Built-in device pairing for all URLs
IMPORTANT: When using ActiveCode subscriptions, authentication parameters must be included in ALL streaming URLs, not just API endpoints.
# Live stream playback URL
http://your.dns:stream_port/live/{ActiveCode}/{DecryptPassword}/{stream_id}.ts?mac={yourdeviceid}
http://your.dns:stream_port/live/{ActiveCode}/{DecryptPassword}/{stream_id}.m3u8?mac={yourdeviceid}
# With Application Lock
http://your.dns:stream_port/live/{ActiveCode}/{DecryptPassword}/{stream_id}.ts?mac={yourdeviceid}&appname={YourAppName}
# VOD playback URL
http://your.dns:stream_port/movie/{ActiveCode}/{DecryptPassword}/{vod_id}.mp4?mac={yourdeviceid}
http://your.dns:stream_port/movie/{ActiveCode}/{DecryptPassword}/{vod_id}.mkv?mac={yourdeviceid}
# With Application Lock
http://your.dns:stream_port/movie/{ActiveCode}/{DecryptPassword}/{vod_id}.mp4?mac={yourdeviceid}&appname={YourAppName}
# Series episode playback URL
http://your.dns:stream_port/series/{ActiveCode}/{DecryptPassword}/{episode_id}.mp4?mac={yourdeviceid}
# With Application Lock
http://your.dns:stream_port/series/{ActiveCode}/{DecryptPassword}/{episode_id}.mp4?mac={yourdeviceid}&appname={YourAppName}
# M3U playlist URL
http://your.dns:stream_port/get.php?username={ActiveCode}&password={DecryptPassword}&type=m3u_plus&output=ts&mac={yourdeviceid}
# With Application Lock
http://your.dns:stream_port/get.php?username={ActiveCode}&password={DecryptPassword}&type=m3u_plus&output=ts&mac={yourdeviceid}&appname={YourAppName}
mac parameter will be rejected for ActiveCode subscriptions. Always ensure the Device ID is included in every URL.
This key is crucial for decrypting the password string your app will receive.
Navigate to: General Settings > General Tab > Load Balancing Key
This is the unique password associated with an ActiveCode (additional security) that your app will need to retrieve.
Navigate to: General Settings > Streaming Tab > Unique Password
Make a GET request to the following API endpoint to retrieve the encrypted unique password string.
GET http://your.dns:stream_port/player_api.php?action=getactivecodepass
Use the Load Balancing Key you set in the panel to decrypt the string received from the player_api call. We've provided the necessary functions in multiple languages below.
Once you have the decrypted password, you can authenticate the user via the Player API and use these credentials for ALL URLs.
Below are all available Player API endpoints. Replace the placeholders with your actual values:
{yourdeviceid} - Required Your unique device identifier (required on ALL URLs){ActiveCode} - The ActiveCode username{DecryptPassword} - The decrypted password from step 2{YourAppName} - Optional Your application name or fixed serial for app locking (if used, required on ALL URLs)X - Specific ID values (category_id, stream_id, etc.)mac parameter is REQUIRED on ALL URLs when using ActiveCode subscriptions. The appname parameter is optional but if used, it must be included in ALL URLs consistently.
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_live_categories
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_live_categories&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_live_streams
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_live_streams&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_live_streams&category_id=X
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_live_streams&category_id=X&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_short_epg&stream_id=X
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_short_epg&stream_id=X&limit=X
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_short_epg&stream_id=X&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_simple_data_table&stream_id=X
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_simple_data_table&stream_id=X&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_vod_categories
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_vod_categories&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_vod_streams
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_vod_streams&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_vod_streams&category_id=X
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_vod_streams&category_id=X&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_vod_latest
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_vod_latest&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_vod_info&vod_id=X
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_vod_info&vod_id=X&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_series_categories
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_series_categories&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_series
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_series&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_series&category_id=X
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_series&category_id=X&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_series_latest
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_series_latest&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_series_info&series_id=X
# With Application Lock (Optional)
GET http://your.dns:stream_port/player_api.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&action=get_series_info&series_id=X&appname={YourAppName}
GET http://your.dns:stream_port/player_api.php?action=getactivecodepass
GET http://your.dns:stream_port/xmltv.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}
# With Application Lock (Optional)
GET http://your.dns:stream_port/xmltv.php?mac={yourdeviceid}&username={ActiveCode}&password={DecryptPassword}&appname={YourAppName}
Here are the functions for AES-256-CBC decryption. Use the `decrypt` function in your application with your Load Balancing Key to decode the API response.
function decrypt($data, $key) {
$key = hash('sha256', $key, true);
$data = base64_decode($data);
$iv = substr($data, 0, 16);
$ciphertext = substr($data, 16);
return openssl_decrypt($ciphertext, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
}
import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;
import java.util.Base64;
public class Crypto {
public static String decrypt(String data, String key) throws Exception {
byte[] keyBytes = MessageDigest.getInstance("SHA-256").digest(key.getBytes());
byte[] combined = Base64.getDecoder().decode(data);
byte[] iv = new byte[16];
byte[] ciphertext = new byte[combined.length - 16];
System.arraycopy(combined, 0, iv, 0, 16);
System.arraycopy(combined, 16, ciphertext, 0, ciphertext.length);
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(keyBytes, "AES"), new IvParameterSpec(iv));
return new String(cipher.doFinal(ciphertext));
}
}
import javax.crypto.Cipher
import javax.crypto.spec.IvParameterSpec
import javax.crypto.spec.SecretKeySpec
import java.security.MessageDigest
import java.util.Base64
object Crypto {
fun decrypt(data: String, key: String): String {
val keyBytes = MessageDigest.getInstance("SHA-256").digest(key.toByteArray())
val combined = Base64.getDecoder().decode(data)
val iv = combined.copyOfRange(0, 16)
val ciphertext = combined.copyOfRange(16, combined.size)
val cipher = Cipher.getInstance("AES/CBC/PKCS5Padding")
cipher.init(Cipher.DECRYPT_MODE, SecretKeySpec(keyBytes, "AES"), IvParameterSpec(iv))
return String(cipher.doFinal(ciphertext))
}
}
const crypto = require('crypto');
function decrypt(data, key) {
const keyBuf = crypto.createHash('sha256').update(key).digest();
const combined = Buffer.from(data, 'base64');
const iv = combined.subarray(0, 16);
const ciphertext = combined.subarray(16);
const decipher = crypto.createDecipheriv('aes-256-cbc', keyBuf, iv);
let plaintext = decipher.update(ciphertext);
plaintext = Buffer.concat([plaintext, decipher.final()]);
return plaintext.toString('utf8');
}
/*
Add dependencies to your pubspec.yaml:
dependencies:
encrypt: ^5.0.1
crypto: ^3.0.1
*/
import 'dart:convert';
import 'dart:typed_data';
import 'package:crypto/crypto.dart';
String decrypt(String data, String key) {
final keyBytes = sha256.convert(utf8.encode(key)).bytes;
final combined = base64.decode(data);
final iv = IV(Uint8List.fromList(combined.sublist(0, 16)));
final ciphertext = Encrypted(Uint8List.fromList(combined.sublist(16)));
final encrypter = Encrypter(AES(Key(Uint8List.fromList(keyBytes)), mode: AESMode.cbc));
return encrypter.decrypt(ciphertext, iv: iv);
}
mac parameter to streaming URLsappname consistently across all URLs when it's configured