StreamCore - IPTV/OTT Platform with Reseller Panel & Android TV App

StreamCore – Monetization-Ready IPTV & OTT Platform

Turn your server into a subscription streaming business.

StreamCore is a complete, self-hosted IPTV/OTT platform designed to help you launch fast, sell subscriptions, and manage growth with full control.

No external CMS. No plugin chaos. No lock-in.

Why Buyers Choose StreamCore

• Built to generate revenue from day one with reseller credits, Stripe payments, and pricing controls
• Professional user experience across web and Android TV to increase retention
• Enterprise-grade architecture with Rust backend for high-concurrency workloads
• Operational control in one place: users, content, billing, security, logs, support
• Full ownership: complete source code included (backend, frontend, Android TV)

What You Get

• Rust backend + complete REST API
• Next.js 15 + React 19 web platform
• Native Kotlin Android TV app (Media3/ExoPlayer + FFmpeg fallback)
• Multi-reseller credit system with transparent pricing logic
• Stripe integration with webhook support and volume discounts
• DRM-ready playback (Widevine via your license URL, ClearKey, PlayReady best-effort on Android)
• Security signals (device fingerprinting, emulator detection, IP banning)

Business Features That Increase Sales

• Reseller economy with wallet-style credit purchases
• Flexible subscription creation (duration + device limits)
• Transparent pricing formula for predictable margins
• Volume discount tiers to drive larger purchases
• Gift codes for promotions and campaigns
• Billing analytics with transaction history and revenue tracking

Complete Ecosystem Included

Admin Console

• Real-time dashboards and activity analytics
• Users, resellers, credits, and account lifecycle control
• Content management for Live TV, Movies, Series, Kids, Anime, and Events
• Security center (incidents, IP bans, device blacklist)
• Support tickets, task control, and full audit logs

Reseller Panel

• Fintech-style wallet dashboard
• Credit purchases via Stripe checkout
• User creation with configurable device plans
• Growth analytics, expirations, and device management

End-User Web App

• Modern responsive UI with theme support
• Continue watching, favorites, history, and profile controls
• Personalized discovery rails and hero sliders
• Web player with subtitles, audio tracks, speed controls, fullscreen

Native Android TV App

• D-pad/remote-first navigation + voice search
• Media3 playback + FFmpeg fallback for problematic codecs
• DRM support and adaptive streaming playback
• EPG, favorites, live channel controls, episodic playback

Content Ingestion & Automation

• Unlimited Live TV channels with categories + XMLTV EPG
• VOD movies and TV series with TMDB metadata automation
• M3U/M3U8 provider imports with refresh controls
• Media scanner + watched-folder auto-import workflows
• Per-channel advanced options (headers, proxy URL, DNS-over-HTTPS, DRM fields)

Security Layer

• JWT authentication + bcrypt hashing
• Two-factor authentication (TOTP + backup codes)
• Password reset and device/session controls
• IP banning and device blacklist management
• Android anti-emulator and fingerprint signaling

Live Demo

Web Demo: https://streamcore.drm.lat/

• Admin: admin / 22333265
• Reseller: reseller / 1155
• User: test / 1155
• Demo data resets every 30 minutes

Android TV Demo APK: https://media.drm.lat/files/app-debug_tv.apk

Android Phone Demo APK: https://media.drm.lat/files/app-release_phone.apk

Android Phone Separated Add-On:

Demo App Login: Username: test / Password: 1155

CodeCanyon Item Page: https://codecanyon.net/item/streamcore-native-android-stream-app-iptvott-mobile-client-addon/62130690

Screenshots

High-impact screens that help buyers understand value in seconds:

Admin Dashboard

Reseller Panel

Android TV App – Home

User Interface – Live TV

Content Management

Web Login

User Interface – Home

Android TV App – Movies

Android TV App – Live TV

Android Phone App – Sneak Peek (Coming Soon)

Roadmap Add-ons (Sold Separately)

• iOS app
• Android phone app
• webOS TV app (LG Smart TVs)

All add-ons are planned to work with your existing StreamCore backend.

What Is Included After Purchase

• Rust backend source code (unencrypted)
• Next.js frontend source code (unencrypted)
• Android TV Kotlin source code
• Documentation, migration files, and integration guides
• Language files (EN, ES, ZH)

Server Requirements (Summary)

• VPS or dedicated server with root access (shared hosting not supported)
• Linux server (Ubuntu/Debian/CentOS compatible)
• Recommended: Docker + Nginx + SSL
• Node.js 18+ / 20+ for frontend

Optional Setup Service

Want a faster launch? Professional installation is available for $25 USD (Docker, Nginx, SSL on your VPS). Contact via item support after purchase.

Change Log

Version 1.1.3 – February 2026

Content Management

• Home screen sorting updated from A-Z to Latest Added for Movies, Series, and Kids.
• TMDB-based creation flow improved to allow manual media handling in mixed import scenarios.
• Manual subtitle upload workflow finalized for content and episodes, including language mapping improvements.
• Bulk import for Movies and Series improved for M3U/M3U8 provider playlists.
• M3U parser now supports real-world playlist variants: blank lines between EXTINF and URL, unquoted attributes, and URL-only fallback when EXTINF is missing.

Localization / i18n

• Additional hardcoded UI text replaced with translation keys in frontend, Android TV, and Android Phone modules.
• Translation consistency pass completed for audited namespaces and shared components.
• Language sync behavior adjusted to better respect configured and stored locale values.

Stability

• Series and episode creation flows stabilized when combining URL-based and file-based media inputs.
• General admin-panel fixes for media upload and subtitle management UX.

Version 1.1.2 – February 2026

Core

• Version alignment to 1.1.2 across backend, frontend, Android TV, and Android Phone.
• Android Phone app integrated as a first-class module in the main package.

Security

• Stricter URL validation for Live TV stream/proxy/DoH/license inputs.
• Stream and subtitle proxy hardening with anti-SSRF checks, host allowlist controls, and optional authentication requirements.

Backend

• Added password reset flow with token verification and SMTP support.
• Added 2FA management for supported roles.
• Added reseller/master API key management and public API v1 authentication via API keys.
• Added gift code support, TV provider sync, and media watcher services.
• Expanded auth/security controls for account incidents and protection.

Frontend Web

• UI/UX improvements across admin, reseller, and end-user panels.
• Improvements in app version management and system configuration flows.
• Additional proxy and playback flow hardening in management screens.

Android TV / Android Phone

• Android TV update flow, navigation, and playback stability improvements.
• Android Phone compatibility and update workflow improvements.
• App version reporting consistency improvements.

Version 1.1.0 – January 2026

Security and Validation

• Anti-injection hardening with stronger server-side validation and sanitization rules.

Backend / API

• New TMDB credits/cast endpoint added.
• Backend compatibility improvements for Android Mobile integration paths.

Frontend Web

• API URL handling fixes (removed incorrect fallback behavior).
• i18n namespace loading fixes and general bug fixes.

Android TV

• EPG window expanded from 6 hours to 24 hours.
• Update dialog improvements (focus handling, progress feedback, and UX polish).
• Additional player/navigation bug fixes.

Infrastructure

• Increased upload limits for large media/APK workflows.
• Custom nginx support improvements for upload and reverse proxy scenarios.

Version 1.0.1 – January 2026

Database and Performance

• Full database migration from SQLite to PostgreSQL 16.
• N+1 query optimization and large import performance improvements.

Internationalization

• Full internationalization rollout across web and Android apps (8 languages).

Security

• Stream delivery fixes to prevent JWT token leakage to external URLs.

Platform Stability

• Bug fixes across backend, frontend, Android TV, and Android Phone.
• Docker and deployment documentation improvements (health checks, backup, and restore guidance).

StreamCore v1.2.0 — Update Notes

️ Security

• API keys are now cryptographically hashed — plaintext shown only once at creation
• Patched IP header spoofing (X-Forwarded-For / X-Real-IP)
• 2FA fail-open vulnerability fixed — login denied if 2FA status cannot be confirmed
• Password reset tokens are now atomic — prevents parallel reuse
• Stripe webhook double-credit prevention (atomic idempotency)
• Gift code double-spend prevention (row-level locks)
• Stripe unknown subscription states now default to “inactive” instead of “active”
• Email verification tokens upgraded to cryptographically secure random strings
• SMTP passwords encrypted at rest with AES-256-GCM
• Public gift code redemption & demo creation default to DISABLED for safety
• Rate limit fail-open patched — errors now properly block requests

Bug Fixes

• Database schema search path reordered — app schemas now take priority over public
• All migration DDL schema-qualified to prevent cross-schema issues
• Series/Anime edit dialog now opens the correct editor (seasons + episodes)
• Events edit dialog routing fixed
• Episode management dialog i18n fixes (no more broken translation keys)
• ClearKey DRM format standardized (kid_hex:key_hex) across backend, frontend, and mobile apps
• ClearKey k/kid swap bug from v1.1.2 diagnosed and fixed
• Phone app: Referer header restored — fixes 403 errors on DRM-protected CDNs
• Phone app: DASH manifest parser fully rewritten for correct ClearKey injection
• Device registration now persists locally — no more prompts on every app launch
• Episodes now inherit DRM keys from parent Series/Anime content
• Subtitle URL priority: English preferred, then first available
• Bulk user update SQL fix (duplicate SET clauses removed)
• Proxy auth endpoint corrected (was calling non-existent route)
• Registration auto-login token key mismatch fixed
• Device API response contract mismatches resolved
• Search “Sort by Rating” now actually sorts by rating
• Duplicate sidebar renders removed from user pages
• Broken support link on credits page fixed

✨ New Features & Enhancements

• Per-file upload progress bars with real-time percentage
• EPG display fixed on phone app — now uses correct bulk endpoint
• Live TV overlay redesigned — modern transparent sidebar with spatial navigation
• HEVC 10-bit playback improvements for Xiaomi MiTV devices
• Overlay-based channel navigation with number-key selection on TV app
• Immediate billing entry generation on premium package assignment
• Series creation overhaul — full season/episode data in a single request
• Per-episode multi-stream support (quality, language, audio, format, DRM per episode)
• Episode stream editor UI with add/edit/delete and set-default actions
• URL validation relaxed to accept local filesystem paths
• Responsive creation/edit dialogs (mobile → tablet → desktop)
• TMDB year auto-fill no longer crashes on missing release dates
• Anime manual creation correctly categorized
• Watch progress API — granular episode position queries
• Admin UI: Stripe payment config & server settings manageable from dashboard (DB-backed with env var fallback)
• Sensitive config values (Stripe keys) encrypted at rest

⚙️ Configuration

• TRUST_ALL_PRIVATE_PROXIES (default: false) — for Docker/reverse proxy setups
• PG_MIN_CONNECTIONS / PG_MAX_CONNECTIONS / PG_ACQUIRE_TIMEOUT_SECS — DB pool tuning
• STREAMCORE_SMTP_KEY — AES-256-GCM key for SMTP password encryption

New admin panel config keys:

• public_redeem_enabled / public_demo_enabled (default: disabled)
• demo_duration_hours / demo_creation_threshold / demo_ban_duration_days

️ Database Migration

• All migrations run automatically on startup
• Master API keys are invalidated — regenerate after upgrade
• Full v1.1.2 backup compatibility (auto-migration of 44 tables to correct schemas)
• New episode_id column on media_streams for per-episode multi-stream support
• Safe, idempotent, FK-ordered migrations with sequence auto-fix

Performance

• 77K+ requests/second on content endpoints
• 7.5ms average latency (content)
• 0 errors across all load tests (500 concurrent workers)
• 82 automated tests (62 unit + 20 integration) — all passing
• IP-based login rate limiting (10/min, 50/hr per IP)
• Enhanced health check with database connectivity verification
• Graceful shutdown on SIGTERM/SIGINT

Code Quality

• 64 → 0 compiler warnings
• Removed 6 dangerous .unwrap() calls
• Closed 4 fail-open security patterns
• Unified role-based access control across 100+ locations

Support Policy

• Support channel: CodeCanyon item support
• Response time: 24-48 business hours
• Included: installation guidance, bug fixes, configuration help
• Not included: custom development, third-party integrations, server administration

Legal Notice

StreamCore is self-hosted software. It does not include streams, channels, IPTV lists, EPG sources, or copyrighted media. You are responsible for legal usage and licensing in your jurisdiction.

TMDB API keys are not bundled. Buyers must use their own keys and comply with TMDB terms.

Start Selling Under Your Own Brand with StreamCore

If you want a serious IPTV/OTT platform focused on revenue, control, and scalability, StreamCore gives you the full stack to launch and grow.