XMAX is the full-stack IPTV platform operators use to import providers, manage channel lineups, transcode live, sell to subscribers and resellers — and bill every layer through WHMCS. One Go deployment on your own servers — handed out by invitation only, never sold off the shelf.
Channel import, live transcoding, user & reseller management, apps for every screen, and WHMCS billing — shipped as one Go binary + admin dashboard. No gluing five vendors together.
Import from M3U, Xtream Codes, or Emby. Auto-sync on schedule. Group channels into bouquets, assign bouquets to packages, assign packages to users. Drag, drop, done.
Purpose-built transcoder with NVENC / QSV / VAAPI hardware acceleration. Stream proxy, adaptive bitrate, HLS, MPEG-TS. Spins up workers per stream automatically.
Unlimited-depth reseller hierarchy with credit pools. Auto-deduct on provision, refund on deletion, every movement audited. Resellers build their own resellers.
A React 19 + MUI 7 admin panel with 70+ configurable themes. Per-channel viewer minutes, reseller performance, rebuffer rates, device breakdowns — all queryable, all live.
Ships with two WHMCS 9 modules: one for customer & reseller subscriptions, one for platform-license billing. InvoicePaid → account renewed, automatically.
Ship your brand on iOS, Android, and Android TV. Plus full Xtream Codes compatibility — subscribers can use IPTV Smarters, TiviMate, MAG, Formuler, or VLC with the credentials you issue them.
The XMAX admin panel is a React 19 dashboard with 70+ themes, built on Material UI 7. Channels, users, resellers, packages, bouquets, analytics — one pane of glass.
Three services, one Go binary for each, WebSocket-linked across your fleet. Import, transcode, distribute — every stage owned by XMAX. No glue scripts.
Credential sharing. Botnet scraping. Endless resellers going rogue. The classic Xtream-based setups leak revenue by design. XMAX ships with the enforcement every operator actually needs — and that your subscribers can't work around.
max_devices caps how many can exist per line. A subscription you sold to one customer can't be used by 50 people on Telegram.max_connections is a hard cap, checked on every stream open. Sold a 2-connection line? That's all they get, no matter how many devices are registered.player_api.php kill credential stuffing and scraping attempts before they drain your bandwidth. Suspicious patterns trigger automatic suspension.An admin REST API for the dashboard. A v1 client API for your branded apps. And player_api.php — the Xtream Codes compatibility layer, so IPTV Smarters, TiviMate, MAG, and Enigma2 boxes work the moment you hand over credentials.
Ship white-label iOS, Android, and Android TV apps under your own brand. For everything else — MAG, Formuler, IPTV Smarters, TiviMate, VLC — our Xtream Codes compatibility layer gets subscribers streaming in seconds.
XMAX speaks Xtream Codes fluently, so any player that speaks Xtream just works. No custom installers. No support tickets. Hand over credentials — they stream.
There's no checkout button, and there never will be. Every operator running XMAX was brought in by someone already inside the network. That referral chain isn't a marketing gimmick — it's the security model. Keeping XMAX out of open hands is what keeps it hard to fingerprint, hard to probe, and effectively exploit-free.
Already know an operator on XMAX? Ask them to refer you in.