OpenStream TV Help Centre

OpenStream TV runs a TV server on your computer, router or home server. You watch live channels in a browser, check schedules, and use playlist links with an IPTV player. Supported accounts can also browse movies and shows.

New here? Follow Getting Started in 5 Minutes. It explains the difference between the server’s admin password and your TV account, and gets you to the channel list.

Find your next step

• Getting started for a five-minute walkthrough
• Installation for Linux, macOS, Windows, OpenWrt, SBCs, Termux and Docker
• Accounts for JioTV sign-in and optional JioTV+
• Using OpenStream TV for live TV, programme guide, movies, shows and IPTV
• Configuration for verified server options
• Troubleshooting for errors and fixes
• Maintenance for updates, backups and logs

The guide describes the current Rust server and Svelte web interface. Some channel availability, playback, JioTV+ content and DRM depend on your account, your browser and the content provider.

Your playlist link carries access to the server. Treat it like a password. Never share your data directory, session cookies, OTP codes, or diagnostic logs containing tokens publicly.

For support and development discussion, join the OpenStream TV Discord.

Browse all articles.

Start here

First install OpenStream TV, connect your provider account, and learn your way around.

Articles

• Getting Started in 5 Minutes
• What Is OpenStream TV?
• Requirements and Supported Devices
• JioTV and JioTV+: Which Account Do You Need?
• Choose the Right Installation Method
• First Launch and Admin Setup
• Find Your Way Around the Web Interface
• Watch Your First Live Channel

All help centre articles.

Getting Started in 5 Minutes

This is the shortest path from a new installation to browsing live channels. It requires the full build, which includes the browser interface; the slim build is for IPTV clients and has no web UI. You need your own JioTV account and a computer or router that can run the server. Five minutes is the approximate hands-on setup time; downloads and OTP delivery may take longer.

1. Install OpenStream TV

Choose the instructions for your device in Installation. On a supported Linux or macOS machine, the repository’s installer is:

curl -fsSL https://raw.githubusercontent.com/wpfyorg/openstream-tv/main/scripts/install.sh | sh

Review downloaded scripts before running them if that suits your security policy. On Windows, OpenWrt, Termux and Docker, use the matching platform article.

2. Start the server

If the guided installer has already started the service, use the address it printed and do not start a second copy. Otherwise, start it in a terminal:

ost serve

The default address is http://localhost:5001/ on the server itself. The process must remain running while you watch. The terminal prints a private Web setup link on first launch. Copy that complete link into a browser on the server; do not share it. It contains your access key.

For a service on another device, see access from your network.

3. Choose an admin password

The setup page asks you to choose and repeat an admin password with at least eight characters. Select Set password. Afterwards, use the same password when the page asks you to Sign in.

Important: If you opened just / before setting a password, the page tells you to use the Web setup link from the terminal or run ost admin password on the server.

The screenshot shows the actual v1.5.0 password-entry form reached through the private Web setup link. The link is secret because it contains the access key.

4. Connect your JioTV account

1. Open Settings in the top navigation.
2. In the JioTV card, start the mobile-number OTP login.
3. Enter the code that arrives for your account and finish the sign-in.
4. Check that the JioTV card says Logged in.

This is separate from the admin password. If JioTV+ appears, it is an optional source and has its own connection flow.

See Connect your account if you need help.

5. Watch your first channel

1. Choose Channels in the top navigation.
2. Use Search channels, Category, or Language to find a channel.
3. Select a channel tile. The live player opens.
4. Use the player controls for pause/resume, volume, quality or full screen as supported.

The screenshot is from a v1.5.0 JioTV+ session. It proves the current layout and catalogue rendering only; it does not prove that every listed channel will play for every account.

If there are no channels, return to Settings and check connection status. A subscription notice means the content may require a plan; DRM playback may require HTTPS. See Fix channels that do not play.

You can also use an external IPTV app.

What Is OpenStream TV?

OpenStream TV is a small server that runs on a device you control. You open its web interface to browse live channels, select a programme, and watch where your account and device are supported. Its main screen has Channels, On demand, and Settings.

It can provide:

• A channel list with search, category and language filters, HD and availability indicators.
• An in-browser live player with quality controls, programme details, and a programme guide.
• Movies and series in On demand, subject to JioTV+ connectivity, catalogues and provider rights.
• An M3U playlist (a list of channel stream links) and an XMLTV/EPG guide (a TV schedule file) for compatible IPTV applications.
• Admin access, connection status, and account setup in Settings.
• A slim server build with IPTV features and no Svelte web interface.

JioTV account and JioTV+

A JioTV account provides the normal JioTV channel source. JioTV+ is the optional second account and source; the older name Extras still appears in some places. JioTV+ is disabled by default, and availability depends on how the server was configured. A JioTV+ subscription or provider entitlement may be needed for some titles and channels. A channel shown on screen is not a promise that your account can play it.

You also create a separate admin password to protect the OpenStream TV web interface. This password is not your JioTV mobile-number login.

What OpenStream TV does not guarantee

Not every channel is playable on every browser. Protected streams may require a working DRM/Widevine environment and a secure HTTPS browser origin. OpenStream TV cannot grant subscriptions or bypass regional, account, provider or licensing restrictions.

Continue with system requirements or Getting Started in 5 Minutes.

Requirements and Supported Devices

You need a device that can run the Rust ost binary, network access to the content service, and a modern web browser or compatible IPTV application. Watching account-restricted streams requires an eligible JioTV, JioTV+ or Fastway account.

Where you can run the server

The repository supplies installers/build or packaging support for Linux, macOS, Windows, OpenWrt, Raspberry Pi and other Linux single-board computers, and Android through Termux. It also supplies a Docker image. Exact CPU architecture support varies by release; check the platform-specific instructions before downloading.

The full build serves the browser UI. The slim build omits browser assets and is intended for IPTV clients. JioTV+ is a runtime switch (tv_plus = true, JIOTV_TVPLUS=true or OPENSTREAM_TVPLUS=true), not a separate build. Fastway is also optional and enabled with fastway = true or OPENSTREAM_FASTWAY=true.

Where you can watch

• Browser: open the host and port printed by the server, typically http://localhost:5001/ on the same machine.
• Other computers/phones: you must explicitly bind the server to a network interface and use its reachable address. Avoid exposing it to the public internet.
• IPTV app: paste the playlist URL copied from Settings → IPTV playlist, and optionally the EPG URL.

For some protected playback, the browser needs a secure origin (https://), supported encrypted-media APIs, and a licensed DRM module. A supported browser alone is not sufficient: the content may still be blocked by subscription or provider restrictions.

Before you begin

1. Confirm your device architecture and download the matching installer or binary.
2. Keep a writable directory for OpenStream TV state and tokens.
3. Know which device will run the server and which device will open the interface.
4. Have access to your own mobile number and OTP to connect your JioTV account.

Read What is OpenStream TV? or install for your platform.

JioTV, JioTV+ and Fastway: Which Account Do You Need?

OpenStream TV can hold three provider accounts. Provider eligibility and subscriptions decide what each account can use:

• JioTV is the default provider flow. OpenStream TV does not add a fixed-line-network gate to this login, but the provider still decides account and content availability.
• JioTV+ is the optional second source. It is off until tv_plus = true (or JIOTV_TVPLUS=true / OPENSTREAM_TVPLUS=true) is set, and it needs its own sign-in with the JioFiber or AirFiber number, separate from JioTV.
• Fastway is the optional third source. Enable it with fastway = true (or OPENSTREAM_FASTWAY=true) and connect with credentials accepted by the provider. ACT eligibility, where offered, depends on the provider and plan. Fastway supplies live TV, not the on-demand catalogue. See Connect Fastway Live TV.

The installers list only the accounts the downloaded release supports and print this same hint above the account menu. The older name Extras may still appear in older guides and error messages. ost extras login remains a command alias; ost tv+ login is the current spelling.

Check which source is active

1. Open Settings in the web interface.
2. Find the JioTV card. If it says Not logged in, use Send OTP to connect.
3. If the server has JioTV+ enabled, the JioTV+ card shows whether that account is connected. A connected account adds content and a small active icon in the header.
4. Open Channels. Use JioTV+ only if you want to inspect the optional source. If JioTV+ is disconnected, its content might be unavailable.

The screenshot is from a disposable v1.5.0 server with JioTV+ connected and JioTV disconnected. Fastway is disabled in this capture. The existence of a channel tile never guarantees permission to play it.

Understand labels and restrictions

Subscription required means you may need a plan or additional rights. Unavailable can also mean your account is disconnected, the provider rejected playback, the programme is region restricted, or the browser does not support its DRM system. JioTV cannot unlock subscriptions or bypass DRM.

If you need more channels, check the subscription with the provider before changing server settings. See Connect a JioTV account, Connect JioTV+ and Why a channel will not play.

Choose the Right Installation Method

OpenStream TV is a server. One device runs it, and a browser or IPTV application opens its interface or playlist over the network. For example, you can run the server on a Raspberry Pi and watch from a laptop on the same home network.

Choose your server device first:

The full build serves the web interface. A slim build has no web interface and is for IPTV clients. JioTV+ is optional, stays off until it is enabled, and needs a separate account; select the full build if this is your first installation.

What each installation method installs

If you need reproducible deployments, pin a release or container tag instead of following latest.

The Linux, macOS, Windows and OpenWrt installers run a guided setup when they have a terminal: choose the build, choose the account (JioTV, JioTV+, or Fastway when the release supports it), confirm the LAN address, decide whether to use a Cloudflare tunnel, and sign in. Docker and unattended installs skip it and use the documented environment variables instead.

Which provider you can use depends on the account: JioTV uses its mobile-number OTP flow, JioTV+ needs an eligible JioFiber or AirFiber login, and Fastway needs credentials accepted by the provider. ACT eligibility, where offered, depends on the provider.

After installing, use Getting Started in 5 Minutes. If your browser runs on another device, read Access OpenStream TV on your home network.

First Launch and Admin Setup

This guide requires the full build, which includes the browser interface. The slim build supports IPTV clients only and has no web UI. OpenStream TV protects the admin interface with a password and its playlist routes with an access key. The admin password belongs to this local installation; your JioTV account has a separate OTP sign-in.

1. If guided setup already started the service, use its running address; do not start a second copy. Otherwise run ost serve on the host in a terminal.
2. Look for Web setup in the server output or service logs. Open the full URL privately in your browser. The URL includes an access key.
3. Enter a password of eight or more characters, repeat it, then select Set password.
4. Return to the interface and verify that Channels, On demand, and Settings appear after sign-in.

This screenshot is the current v1.5.0 Web setup form from a fresh local data directory. The setup URL itself contains the server access key, so the browser address bar is intentionally not shown.

If you do not have the setup link, you can run ost admin password in the server’s terminal and set the password there. Store it safely. For a remote device, make sure you are opening the OpenStream TV host, not your viewing device’s own localhost.

Never post the setup link, access key or server data directory. For more protection, read Network access and HTTPS. Next: connect JioTV.

Find Your Way Around the Web Interface

After entering your admin password, the top bar has Channels, On demand, Settings and Sign out. A small icon beside the brand indicates when JioTV+ is both enabled and connected.

• Channels is the channel finder. Search by name or filter by category, language, HD or source. A channel tile opens the live player.
• On demand has sections, provider filters and search for available movies or shows. Availability depends on JioTV+ connectivity, catalogue availability and account rights.
• Settings shows account status, OTP sign-in controls, playlist and EPG URLs, password change, and access-key rotation.

When you select a channel, you get the live player and programme details, including the schedule when provided. You can return using All channels. Sign out leaves the admin interface; it does not disconnect the separate provider accounts.

Continue with live TV, accounts, or IPTV playlists.

Watch Your First Live Channel

Once your server is running and your JioTV account says Logged in in Settings, you can try live television.

1. Open Channels in the top bar. You should see a channel grid, a search box and filters.
2. Type the channel name in Search channels, or choose All categories or All languages to narrow the list.
3. Select a channel that your plan is allowed to watch. A Subscription required label means you may not have access.
4. Select its tile. The live player opens. Playback may need a moment to start.
5. Move the pointer over the player to show controls. Change quality, sound or full screen if those controls are offered.

What you should see: The screenshot shows the current v1.5.0 channel browser with JioTV+ connected. A large catalogue count or visible tile is not evidence that every channel is playable for the current account.

The player screenshot was captured from the same JioTV+ session. Playback for the tested JioTV+ channel was later verified manually. The screenshot still documents the player and guide layout; one successful channel does not prove all channels are available or playable.

If the player says Subscription required, try a channel included in your plan. If the player mentions DRM, Widevine, a license, or a secure origin, see Fix DRM playback errors. If the screen remains loading, see Fix a channel that will not play.

For programme information, read Programme guide. The current Svelte UI does not provide catch-up browsing or playback controls even though backend catch-up routes exist. To watch on a TV with an IPTV app, use M3U playlists.

Install OpenStream TV

OpenStream TV runs as a server on a computer or router. Pick the guide for the system where the server will run:

• Linux, including Raspberry Pi and other SBCs
• macOS
• Windows
• OpenWrt
• Android with Termux
• Docker
• Docker Compose for a reusable container setup
• Manual release binary for verified standalone downloads
• Build from source

The full variant includes the browser interface. The slim variant is headless and intended for IPTV clients or systems without a browser interface. Release downloads are checked against the release’s SHA-256 manifest by the supplied installers.

After installation, complete first launch. Keep the server on a trusted network; see network access and HTTPS.

Install on Linux

The installer selects a release for x86_64, 64-bit ARM, ARMv7, or 32-bit x86 Linux. It verifies the downloaded binary using SHA256SUMS before installing it. ARMv6 and MIPS are not release targets.

Install

On a machine with curl or wget, run:

curl -fsSL https://raw.githubusercontent.com/wpfyorg/openstream-tv/main/scripts/install.sh | sh

The default variant is full. To choose a variant or version, download the script first, then run it with the environment setting:

curl -fsSLO https://raw.githubusercontent.com/wpfyorg/openstream-tv/main/scripts/install.sh
OPENSTREAM_VARIANT=slim OPENSTREAM_VERSION=1.5.0 sh install.sh

The installer uses /usr/local/bin when run as root and writable; otherwise it uses $HOME/.local/bin. Set OPENSTREAM_INSTALL_DIR to choose another directory. If the command is not found afterward, add the install directory to PATH and open a new terminal.

Guided setup

Run the installer from a terminal and it walks through setup instead of only dropping a binary in place:

1. Build — full (browser interface plus IPTV) or slim (IPTV only). Use the arrow keys and press Enter.
2. Account — JioTV, JioTV+ or Fastway. The installer describes JioTV as a mobile-number OTP flow, JioTV+ as needing an eligible JioFiber/AirFiber login, and Fastway as needing credentials accepted by its provider. ACT eligibility, where offered, depends on the provider. Only providers supported by the downloaded release are listed.
3. Address — the LAN address other devices will use, pre-filled with the detected one. Press Enter to accept it.
4. Remote access — LAN only, a temporary Cloudflare URL, or a permanent Cloudflare tunnel with a token.
5. Credentials — the sign-in for the account you chose, then an admin password for the full build.

Piping the script into sh still works: every prompt reads /dev/tty, never the curl pipe. When there is no terminal — Docker, CI, cron, redirected output — the flow is skipped and the installer behaves exactly as it did before.

Sign-in is retried up to three times. If it still fails, the binary stays installed, no service is installed or started, and the installer exits non-zero with the command to finish sign-in later. Passwords and one-time codes are never written to disk by the installer; the tunnel token is stored in the service configuration when a service is installed.

Start and sign in

If you skipped the guided setup, sign in with the command for your provider:

# JioTV: mobile-number OTP
ost login otp

# JioTV+: eligible JioFiber or AirFiber login
ost tv+ login

# Fastway: prompts for the provider username and password
ost fastway login

Then protect and start the full web build:

ost admin password
ost serve --host 0.0.0.0 --tls

For JioTV, enter the one-time password when prompted. Fastway instead asks for its provider username and password. The admin password protects the web interface. On the same machine, open https://localhost:5443/ and accept the self-signed certificate warning. From another trusted LAN device, use https://<server-ip>:5443/. IPTV applications use the HTTP playlist on port 5001. The slim build has no browser interface.

To start at boot on a systemd Linux machine, see Background service. To update or remove OpenStream TV, see Update and uninstall.

Installer options

OPENSTREAM_VARIANT accepts full or slim; OPENSTREAM_VERSION accepts latest or a release version; OPENSTREAM_REPO selects the GitHub owner/repository; and OPENSTREAM_INSTALL_DIR sets the binary directory. OPENSTREAM_INSTALL_TLS=0 changes the installer’s printed next-step instructions only. It does not change a running server’s TLS setting.

The guided setup can be scripted with environment variables, which also skip the matching question:

Verify and troubleshoot

Run command -v ost and ost --help to confirm the command is installed. Open the server address in a browser while the process is running. If the shell says the command is missing, check $HOME/.local/bin or your chosen install directory and PATH. If startup reports the port is busy, select an unused port with ost serve --port 5002; see startup fixes.

To update, use ost update and restart your service. To uninstall, stop the process or service, then remove the installed executable; see safe removal. Preserve the data directory if you may reinstall.

Install on macOS

The installer supports Intel (x86_64) and Apple silicon (arm64) Macs. It downloads the latest matching GitHub release by default and checks its SHA-256 checksum. Set OPENSTREAM_VERSION to a release such as 1.5.0 when you need to pin the installed version.

Install

Open Terminal and run:

curl -fsSL https://raw.githubusercontent.com/wpfyorg/openstream-tv/main/scripts/install.sh | sh

Without elevated privileges, the binary goes in $HOME/.local/bin. Add that directory to your shell’s PATH if needed. For example, with zsh:

echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc

Guided setup

In a terminal, the installer also asks how the server should be set up: build (full or slim), account (JioTV, JioTV+, or Fastway when that release supports it), the LAN address other devices will use, whether to expose it through Cloudflare, and the account sign-in. Arrow keys select, Enter confirms, and Ctrl-C cancels without leaving the terminal in a broken state.

The same settings can be supplied up front to skip the questions:

curl -fsSL https://raw.githubusercontent.com/wpfyorg/openstream-tv/main/scripts/install.sh | OPENSTREAM_VARIANT=slim OPENSTREAM_PROVIDER=jiotv OPENSTREAM_TUNNEL=none sh

OPENSTREAM_ONBOARD=never turns the flow off. Piping the script into sh is fine because prompts read /dev/tty, not the pipe; with no terminal the installer behaves exactly as it does without this option.

First run

The guided setup connects the account for you. If it printed a retry command that sources installer.env, use that exact command so the selected provider settings are loaded. If you skipped guided setup entirely, set the matching provider flags in the same shell before signing in and keep that shell open for serve:

# JioTV: mobile-number OTP
export OPENSTREAM_TVPLUS=false OPENSTREAM_FASTWAY=false
ost login otp

# JioTV+: eligible JioFiber or AirFiber login
export OPENSTREAM_TVPLUS=true OPENSTREAM_FASTWAY=false
ost tv+ login

# Fastway: prompts for the provider username and password
export OPENSTREAM_TVPLUS=false OPENSTREAM_FASTWAY=true
ost fastway login

Then protect and start the full web build:

ost admin password
ost serve --host 127.0.0.1 --tls

Open https://localhost:5443/ and accept the self-signed certificate warning. To access the server from other devices on your home network, bind to all interfaces with --host 0.0.0.0 and use your Mac’s LAN address. Keep access limited to a trusted network. The slim build has no browser interface.

For boot-time service setup, see Background service. For updates, see How to Update OpenStream TV; for removal, see Uninstall OpenStream TV Safely.

Verify and troubleshoot

Run command -v ost and ost --help in Terminal. Confirm the browser opens the address selected when starting serve. If ost is missing, confirm your install location is in PATH; restart Terminal after updating the shell profile. If a port is occupied, follow startup fixes.

Update with ost update, restart OpenStream TV, and check the interface. For removal, stop OpenStream TV and delete the binary from your install directory. Keep your data directory unless you want to erase your saved account state; see uninstall.

Install on Windows

The PowerShell installer supports x64, x86, and ARM64 Windows. It downloads the latest matching GitHub release by default, verifies it with the release SHA-256 manifest, installs ost.exe under your local Programs directory, and adds that directory to your user PATH. Use -Version 1.5.0 or set $env:OPENSTREAM_VERSION = '1.5.0' before running the installer when you need to pin the installed version.

Open PowerShell and run:

irm https://raw.githubusercontent.com/wpfyorg/openstream-tv/main/scripts/install.ps1 | iex

Close and reopen PowerShell if ost is not found.

Guided setup

In a PowerShell window, the installer switches to a guided setup after downloading: build (full or slim), account (JioTV, JioTV+, or Fastway when the release supports it), the address other devices will use, whether to expose the server through Cloudflare, and then the account sign-in. Use the arrow keys (or j/k, or the number keys) and press Enter.

The sign-in step asks for the mobile number and one-time password inside the wizard. The OTP is masked, and provider output is captured rather than printed over the screen. For JioTV+ the wizard lists registered connections and asks which one to use; Fastway signs in with a username and password instead. The installer does not store the mobile number or OTP. It saves the selected provider and any named-tunnel token in your Windows user environment. A failed sign-in leaves the binary installed and prints a retry command.

Skip the questions by setting the environment before running the script, or turn the flow off entirely:

$env:OPENSTREAM_VARIANT = 'slim'
$env:OPENSTREAM_PROVIDER = 'jiotv'
$env:OPENSTREAM_TUNNEL = 'none'

$env:OPENSTREAM_ONBOARD = 'never' keeps the plain non-interactive install. Redirected output (CI, scheduled tasks) skips the flow automatically.

The guided installer configures the selected account and admin password but does not keep the server running. After successful guided setup, reuse the exact Start it with: command printed by the installer. It includes the selected provider settings and, when you chose a temporary or named Cloudflare tunnel, the required --tunnel option. If you selected LAN-only access, the equivalent start command is:

ost serve --host 0.0.0.0 --tls

If guided setup ran, it saves the selected provider flags in your user environment. If you skipped it with OPENSTREAM_ONBOARD=never, set the matching provider flags in the same PowerShell session before signing in and keep that session open for serve:

# JioTV: mobile-number OTP
$env:OPENSTREAM_TVPLUS = 'false'
$env:OPENSTREAM_FASTWAY = 'false'
ost login otp

# JioTV+: eligible JioFiber or AirFiber login
$env:OPENSTREAM_TVPLUS = 'true'
$env:OPENSTREAM_FASTWAY = 'false'
ost tv+ login

# Fastway: prompts for the provider username and password
$env:OPENSTREAM_TVPLUS = 'false'
$env:OPENSTREAM_FASTWAY = 'true'
ost fastway login

For the full web build, set the admin password before serve:

ost admin password

Open https://localhost:5443/ on the same PC and accept the self-signed certificate warning. Other devices on your trusted LAN can use https://<this-PC-ip>:5443/; find the address with ipconfig. IPTV players use the authenticated playlist URL printed by the installer. The slim build has no browser interface.

The installer accepts -Variant full|slim, -Version latest|<version>, -InstallDir <directory>, and -Repo <owner/repository>. For example, to install a specific release in a custom directory:

irm https://raw.githubusercontent.com/wpfyorg/openstream-tv/main/scripts/install.ps1 -OutFile install-openstream.ps1
.\install-openstream.ps1 -Version 1.5.0 -InstallDir "$env:LOCALAPPDATA\OpenStream TV"

The installer does not register a Windows service. Keep the terminal running while serving, or use a separately managed service wrapper only if you know how to configure and secure it. Update with ost update; see How to Update OpenStream TV and Uninstall OpenStream TV Safely.

Verify and troubleshoot

Open a new PowerShell window, run Get-Command ost and ost --help, then open the selected server address in a browser while the server is running. If Windows cannot find ost, verify the install folder is on your user PATH and reopen PowerShell. If the server cannot bind its port, see startup errors.

Update with ost update and restart the server. To uninstall, stop it, remove ost.exe from the install directory, and remove an unneeded PATH entry. See uninstall and saved data.

Install on OpenWrt

SSH to the router as root. The installer detects apk or opkg, chooses a supported package ABI, verifies the downloaded package checksum, and installs the package from the latest GitHub release by default. Set OPENSTREAM_VERSION to a release such as 1.5.0 to pin it. Supported package architectures are x86_64, aarch64 Cortex-A53 and ARM Cortex-A7 NEON. Other router architectures are not published.

wget -qO- https://raw.githubusercontent.com/wpfyorg/openstream-tv/main/scripts/install.sh | sh

By default, the installer enables the service and starts it. Open the browser interface at https://<router-ip>:5443/ and accept the self-signed certificate warning. IPTV players use http://<router-ip>:5001/. The normal package is full; for headless installations, set OPENSTREAM_VARIANT=slim before running the script. The slim package has no web interface and requires terminal provider sign-in.

Guided setup

Over an SSH terminal the installer also asks how to set the router up: build (full or slim), account (JioTV, JioTV+, or Fastway when that package supports it), the address other devices will use, whether to expose it through Cloudflare, and the account sign-in. It stops the service before the terminal login and aborts if the service cannot be stopped, so a running process cannot overwrite the new login.

The provider and tunnel choices are written to UCI, so those settings survive a reboot and a package upgrade. The address shown during setup is an installer summary choice, not a UCI setting; configure option host manually if the service must bind to a particular address.

option tunnel_token is stored in /etc/config/openstream, which is readable by root only. option tunnel 1 without a token starts a temporary trycloudflare.com address that changes every start; check logread -e cloudflared for the current one. Read the exposure warning below before enabling either.

Piping the installer is still supported: prompts read /dev/tty, and with no terminal the package installs exactly as before. Use OPENSTREAM_ONBOARD=never to skip the questions, or set OPENSTREAM_PROVIDER, OPENSTREAM_PUBLIC_HOST, OPENSTREAM_TUNNEL and OPENSTREAM_TUNNEL_TOKEN to answer them up front.

The service uses procd and starts at boot. Manage it with:

/etc/init.d/openstream status
/etc/init.d/openstream restart
logread -e openstream

Settings are in /etc/config/openstream; application state, including credentials and TLS material, is under /etc/openstream. After changing UCI settings, run uci commit openstream and /etc/init.d/openstream restart.

Exposure warning

A Cloudflare tunnel publishes the router’s OpenStream TV server on a public hostname. The access key in the playlist path and the admin password are then the only protection, and the DRM license proxy becomes reachable from the internet too. Use a long admin password, prefer the temporary URL when you only need short-lived access, and remove the tunnel when you are done. Without a tunnel, keep the service on your trusted LAN.

To update, run the installer command again so the package manager updates the package. Do not use ost update for a package-managed installation. To uninstall, use apk del openstream or opkg remove openstream; use openstream-slim if that was the installed package. Package removal preserves configuration and application data. See OpenWrt maintenance for package-specific backup and removal details.

Verify and troubleshoot

Run /etc/init.d/openstream status and logread -e openstream over SSH. Load the HTTPS page from a trusted LAN device; the slim package intentionally has no web interface. If installation reports an unsupported architecture, check uname -m and opkg print-architecture (or apk --print-arch where supported) against the package ABI. Do not force an incompatible package. See OpenWrt problems.

Update by rerunning the supported package installer, then restart/check the service. Remove with the matching package manager, using openstream-slim for the slim package. Preserve or back up /etc/openstream and /etc/config/openstream as described in OpenWrt maintenance.

Install on Raspberry Pi and other SBCs

Use a supported Linux distribution such as Raspberry Pi OS, Debian, Ubuntu or Armbian. Check the operating system architecture with:

uname -m

Supported release targets include aarch64 (64-bit ARM), armv7l (32-bit ARMv7), and x86_64. ARMv6 boards, including original Raspberry Pi and Pi Zero systems, are not supported by the published Linux release binaries. A Pi Zero 2 needs a 64-bit OS to use the aarch64 build.

Install using the Linux guide. The installer chooses the release target from the running system. Select full for the browser interface, or slim for an intentionally headless server. For an always-on systemd setup, follow Background service.

For a system-wide service, choose a stable data directory and set OPENSTREAM_PATH_PREFIX consistently before login and service setup. The service setup command saves the selected prefix. See data, backups and logs.

Start, verify and maintain

After using the Linux installation steps, run ost --help to check the binary and ost serve --host 0.0.0.0 --tls for a trusted LAN installation. Visit https://<sbc-lan-address>:5443/ from another device. If the binary reports an architecture or loader error, confirm the board’s CPU and operating system with uname -m, then choose a matching release.

To update, stop the service, run ost update, restart it and check the browser page. To remove the installation, follow update and uninstall. For startup and missing dependency errors, see installation troubleshooting.

Install on Android with Termux

Install Termux from a trusted distribution source and open its terminal. The OpenStream TV installer detects Termux and chooses a supported Android target. It downloads the latest matching GitHub release by default; set OPENSTREAM_VERSION to a release such as 1.5.0 to pin it. Supported targets are aarch64, ARMv7, and x86_64.

pkg update
pkg install curl
curl -fsSL https://raw.githubusercontent.com/wpfyorg/openstream-tv/main/scripts/install.sh | sh

The binary is installed in Termux’s $PREFIX/bin. The installer also runs the guided setup in the Termux terminal: build (full or slim), account (JioTV, JioTV+, or Fastway when the release supports it), the address other devices will use, an optional Cloudflare tunnel, and the account sign-in. Arrow keys select and Enter confirms.

Guided setup writes the selected provider settings to installer.env, but those values are not automatically loaded back into the Termux shell that launched the installer. Before a later manual sign-in or serve, source the generated environment file (or reuse the exact Start it with: command printed by the installer, which already sources it). Configuring autostart only affects future startup and does not load those settings into the current shell. If you skipped the questions with OPENSTREAM_ONBOARD=never, set the matching provider flags in the same Termux shell before signing in and keep that shell open for serve:

# JioTV: mobile-number OTP
export OPENSTREAM_TVPLUS=false OPENSTREAM_FASTWAY=false
ost login otp

# JioTV+: eligible JioFiber or AirFiber login
export OPENSTREAM_TVPLUS=true OPENSTREAM_FASTWAY=false
ost tv+ login

# Fastway: prompts for the provider username and password
export OPENSTREAM_TVPLUS=false OPENSTREAM_FASTWAY=true
ost fastway login

Then protect and start the full web build. If guided setup ran, source installer.env first or reuse the installer’s printed start command so the selected provider settings are present:

ost admin password
ost serve --host 0.0.0.0 --tls

Keep Termux open while the foreground server runs. On the phone, use https://localhost:5443/; other devices on the same trusted network can use the phone’s LAN address. Android may restrict background processes or network access when the app is idle. Termux autostart saves the current OPENSTREAM_* settings, including a named-tunnel token, in a private environment file, then adds a command to bash.bashrc to start OpenStream TV in the background when a shell opens:

ost autostart

If you configure a named tunnel when setting up autostart manually, include its serve flags: ost autostart --args "--tls --tunnel". Autostart saves the current OPENSTREAM_* values privately and refreshes its startup command when you run it again with different flags.

Remove that startup entry with ost autostart remove. Update with ost update. See How to Update OpenStream TV, Uninstall OpenStream TV Safely, and data, backups and logs.

Verify and troubleshoot

Run command -v ost and ost --help in Termux, then open the browser page while the server process is running. If installation fails, check that Termux is up to date and that your device has a supported CPU architecture. If playback or the server stops when the screen turns off, investigate Android’s background power restrictions; autostart alone cannot override them.

Update with ost update; for removal, run ost autostart remove if you enabled it, stop the server and delete its executable. Keep or privately back up the data directory. See uninstall and startup errors.

Install with Docker

The published image supports Linux amd64, arm64, ARMv7 and 386. Docker selects the matching architecture. The latest tag tracks the current full image and slim tracks the current slim image. For a fixed release, use a versioned tag such as 1.5.0 for full or 1.5.0-slim for slim.

Create and start a container with a persistent named volume:

docker run -d --name openstream --restart unless-stopped \
  -p 5001:5001 -p 5443:5443 \
  -v openstream-data:/app/.openstream-tv \
  ghcr.io/wpfyorg/openstream-tv:latest

The container starts the server on all interfaces with HTTPS enabled. On the Docker host, open https://localhost:5443/; from another trusted LAN device, use https://<docker-host-ip>:5443/. Accept the self-signed certificate warning. IPTV players use the HTTP playlist on port 5001. Keep both the container and volume private; the volume contains credentials and the generated TLS key.

Set the admin password from the container’s terminal, then sign in to the web interface and complete JioTV OTP login:

docker exec -it openstream /usr/local/bin/ost admin password

View output with docker logs -f openstream. For updates and backup instructions, see Docker maintenance.

To run headless, use ghcr.io/wpfyorg/openstream-tv:slim. To pass configuration, add supported options such as -e OPENSTREAM_TITLE="Living Room TV" before the image name. Container arguments replace the image’s default command, so preserve --skip-update-check serve --host 0.0.0.0 --port 5001 --tls --tls-port 5443 when setting a custom command. See CLI options.

Verify and troubleshoot

Run docker ps --filter name=openstream to confirm the container is running and docker logs --tail 50 openstream to inspect startup messages. Open the HTTPS page at the host’s configured port. If the port is occupied, choose a different host-side port mapping; if saved accounts disappear after recreation, confirm the openstream-data volume was retained.

Use Docker maintenance to pull updates, back up the volume and uninstall the container. For network errors see Docker and web troubleshooting.

Install OpenStream TV with Docker Compose

Docker Compose keeps the container ports and data volume in one reusable file. Install Docker Engine or Docker Desktop with the Docker Compose plugin first. Check that docker compose version works. The released image supports Linux amd64, arm64, ARMv7 and 386; Docker selects the correct supported image architecture.

1. Create the Compose file

Make a new directory such as openstream-compose and save this content as compose.yaml:

services:
  openstream:
    image: ghcr.io/wpfyorg/openstream-tv:latest
    restart: unless-stopped
    ports:
      - "5001:5001"
      - "5443:5443"
    volumes:
      - openstream-data:/app/.openstream-tv

volumes:
  openstream-data:

The latest image includes the web UI. Use the slim tag only when you want IPTV access without the browser interface. The named volume stores credentials, configuration and local TLS files. Keep it private.

2. Start and check the service

From the directory containing compose.yaml, run:

docker compose config
docker compose up -d
docker compose ps
docker compose logs --tail 50 openstream

Expected result: docker compose ps shows a running openstream service. On the host, open https://localhost:5443/; from a trusted network device, use https://<docker-host-ip>:5443/. A browser warning about the generated self-signed certificate is expected. Port 5001 serves plain HTTP for compatible IPTV clients.

3. Set the admin password and connect JioTV

The first-run server can provide a private web setup URL in its logs. Do not share that link: it contains an access key. You can instead set the password interactively from your Compose directory:

docker compose exec openstream /usr/local/bin/ost admin password
docker compose restart openstream

Then open the web page, sign in with the admin password and connect your provider account in Settings using its OTP form. See first launch and account connection.

4. Update and inspect the container

Stop playback before updating, then run:

docker compose pull
docker compose up -d
docker compose ps
docker compose logs --tail 50 openstream

Expected result: Compose recreates the service when the image has changed and keeps the same openstream-data volume. Reopen Settings to confirm the account is still connected. See Docker maintenance to back up the volume before major updates.

5. Stop or uninstall

Run docker compose stop for a temporary stop, docker compose start to resume, or docker compose down to remove the container and its network while keeping the saved volume. Do not use docker compose down -v unless you deliberately want to delete the saved provider accounts, password and settings. See Docker troubleshooting for port conflicts and missing data.

Install OpenStream TV Manually from a Release Binary

Use this method if you want to inspect the download and install the executable yourself. The normal platform installers automate these steps.

1. Pick the correct download

Visit the OpenStream TV GitHub releases and choose the asset matching both your operating system and CPU. Asset names begin with openstream-full- or openstream-slim-. Use full for the web interface; slim runs without it for IPTV clients. The release workflow builds Linux (x86_64, aarch64, ARMv7, i686), macOS (Apple silicon and Intel), Windows (x64, x86, ARM64), and Termux (aarch64, ARMv7, x86_64) variants. OpenWrt users should generally install the appropriate package.

The example below follows the latest release. To pin a release, download the same asset and SHA256SUMS from https://github.com/wpfyorg/openstream-tv/releases/download/v<version>/, replacing <version> with the release you selected.

For example, a typical 64-bit Intel/AMD Linux machine uses openstream-full-x86_64-unknown-linux-musl. The commands below are for this Linux target only. Do not use that binary on Windows, macOS, ARM or Android.

2. Download and verify the Linux example

Open a terminal with curl and sha256sum installed, and choose a fresh directory:

mkdir -p "$HOME/openstream-download"
cd "$HOME/openstream-download"
asset=openstream-full-x86_64-unknown-linux-musl
base=https://github.com/wpfyorg/openstream-tv/releases/latest/download
curl -fLO "$base/$asset"
curl -fLO "$base/SHA256SUMS"
grep -F "  $asset" SHA256SUMS | sha256sum -c -

Expected result: the checksum check prints OK. Stop if the file is missing or the checksum fails. The checksum checks that your download matches the release’s published manifest; for higher assurance, independently confirm you trust the release source.

On macOS, download the matching apple-darwin asset and verify it using shasum -a 256 instead of sha256sum. On Windows, the PowerShell installer handles the executable and checksum for you.

3. Install and check the command

Still in the Linux download directory:

mkdir -p "$HOME/.local/bin"
install -m 0755 "$asset" "$HOME/.local/bin/ost"
"$HOME/.local/bin/ost" --help

Expected result: the command shows serve, login, admin, and other available commands. Add $HOME/.local/bin to your shell’s PATH if typing ost alone says command not found, or keep using the full executable path.

4. Set up and start OpenStream TV

"$HOME/.local/bin/ost" admin password
"$HOME/.local/bin/ost" login otp
"$HOME/.local/bin/ost" serve --host 127.0.0.1 --tls

Choose an admin password and complete the OTP prompts for your own JioTV account. Open https://localhost:5443/ on that machine. Your browser may warn about the locally generated self-signed certificate. The server also listens on HTTP port 5001 for IPTV clients. To reach the interface from another device, see network configuration before changing the bind address.

The executable runs while its terminal is open. See background services for startup options. Account sign-in can also be completed in Settings.

5. Update, remove or troubleshoot

Stop the running server before updating. Run ost update (or the full path to your executable), restart the server, and check that the interface opens. See update guidance.

To uninstall this example, stop OpenStream TV and remove only $HOME/.local/bin/ost. Your data under $HOME/.openstream-tv is separate; keep it if you plan to reinstall. To erase saved accounts too, first read safe uninstallation.

If the downloaded binary reports an unsupported architecture, recheck the asset name against uname -m. If execution is denied, check its execute permission. If the server cannot start, see installation and startup fixes.

Build OpenStream TV from source

Use this method when you need a local build or your system has no matching release binary. You need Git and a current stable Rust toolchain with Cargo. The full build is the default; the slim build excludes the embedded browser UI.

Clone the repository and compile:

git clone https://github.com/wpfyorg/openstream-tv.git
cd openstream-tv
cargo build --release

The binary is target/release/ost. To build slim:

cargo build --release --no-default-features --features slim

Run it in place to try it, or install it to a directory on PATH:

mkdir -p "$HOME/.local/bin"
install -m 0755 target/release/ost "$HOME/.local/bin/ost"

Cross-compiling requires a Rust target toolchain and linker suitable for the destination. The repository’s release workflows define the supported target triples; a successful local build does not guarantee compatibility with a different libc or CPU. For OpenWrt, use the matching OpenWrt SDK and the supplied scripts/build-openwrt-packages.sh, which requires full and slim binaries plus the SDK path and version. Follow that script’s usage line for its exact arguments.

See first launch, CLI commands and update and uninstall for operating the compiled binary.

Start, verify and maintain

Run ./target/release/ost --help to verify the binary starts on the build machine. If the full build is installed on your PATH, run ost serve and browse to http://localhost:5001/ on that machine. A slim build does not serve the browser UI.

To update a source installation, fetch the intended source revision and rebuild, then replace your installed executable while the server is stopped. To uninstall, remove the executable and any service registration you created. Keep the private data directory unless you mean to erase saved logins. See startup troubleshooting.

Accounts and sign-in

Connect the JioTV provider account and, if enabled, JioTV+ channels. Admin access is separate.

Articles

• Connect Your JioTV Account
• Switch to Another JioTV Account
• Connect JioTV+
• Connect Fastway Live TV
• Admin Sessions and Sign Out

All help centre articles.

Connect Your JioTV Account

The JioTV account supplies channels from your account. It is separate from the admin password you use to open this server.

1. Sign in to the web interface with the server’s admin password.
2. Open Settings and find the JioTV card.
3. Enter the 10-digit mobile number for your JioTV account and select Send OTP.
4. Enter the code sent to that number, then select Log in.
5. Check that the card says Logged in, then return to Channels.

Expected result: the JioTV account status is logged in and the channel list can load the channels available to that account. A channel may still require a subscription or be unavailable from the provider.

If the OTP fails or expires, request a fresh code and enter it promptly. If the channel list is empty, refresh the page and check the account status in Settings.

For first-time server setup, see First Launch and Admin Setup. To connect the optional source, see Connect JioTV+.

To replace an existing account, follow Switch to Another JioTV Account.

Switch to Another JioTV Account

The server currently uses one active JioTV provider account at a time. There is no multi-account picker in the web interface. To use a different mobile number, sign out of the current JioTV connection and sign in again. Your admin password and optional JioTV+ channels connection are separate.

Switch in Settings

1. Open Settings while signed into the OpenStream TV web interface.
2. In the JioTV card, select Log out, then confirm. This button appears for a connected account when provider logout is allowed. It is available by default unless an administrator sets disable_logout = true or OPENSTREAM_DISABLE_LOGOUT=true.
3. In the same card, enter the new account’s mobile number and request an OTP.
4. Enter the OTP sent to that number to finish signing in.
5. Return to Channels and reload the channel list.

Expected result: Settings reports Logged in for the new provider account. The available channels and programme guide may change based on that account’s plan. Existing playlist links may need refreshing after an account change.

The current Settings view below shows the JioTV sign-in form while JioTV+ is connected separately. It illustrates where to enter the replacement JioTV account; it does not show a completed switch.

Switch using the CLI

If logout is disabled in Settings, or you manage a headless server, use the commands below. Stop OpenStream TV before changing the credentials so the running process does not overwrite the new state.

ost login reset
ost login otp

Both commands must run as the same operating-system user and with the same configuration/data directory used by the server. The first clears the JioTV login; the second prompts for the new number and OTP. Then restart OpenStream TV using your original command or service manager. For OpenWrt, follow its service-management instructions. For a Docker install, prefer the Settings workflow unless you know how to run commands against the container’s persistent volume.

If switching does not work

If the old account still appears, ensure you stopped the correct server and used its actual data directory. If the OTP fails, request a fresh one. If channels differ after login, the new account may have different entitlements; see login troubleshooting. Switching JioTV does not automatically reconnect or disconnect JioTV+ channels.

Connect JioTV+

JioTV+ is an optional second source. It appears in Settings when tv_plus is enabled and the account has not been locked. A Lock selection is saved and overrides the server setting across restarts; unlock JioTV+ from Channels with the account’s unlock code. It requires a separate registered mobile number and an eligible plan.

1. Open Settings and find JioTV+ channels.
2. Enter the registered 10-digit mobile number and select Continue.
3. If asked, choose the matching connection from the list, then select Send OTP.
4. Enter the OTP and select Connect.
5. Check that the card says Connected. The header also shows a JioTV+ indicator while the source is enabled and connected.
6. Return to Channels. Use JioTV+ only to narrow the list when more than one source is visible.

Expected result: channels supplied by the connected source appear when available. A channel can still require a plan or be unavailable for playback.

To disconnect, select Disconnect on the card and confirm. Lock turns off the JioTV+ source without disconnecting its provider account; it does not sign out the web interface. The server may hide provider logout controls when logout is disabled in its configuration.

If the source is unavailable in Settings, check the tv_plus setting in server configuration and whether JioTV+ has been locked. A saved lock must be cleared from Channels with the unlock code; changing tv_plus alone does not clear it.

Connect Fastway Live TV

Fastway is an optional third-party live-TV source. It is separate from the JioTV account and from JioTV+ (formerly called Extras), and it is disabled by default. You need credentials that Fastway accepts for live-TV service; the server never grants or bypasses provider entitlements. ACT eligibility, where offered by the provider, depends on that provider and plan.

Enable Fastway

Fastway is available in the standard build but stays off until the server configuration enables it:

# openstream.toml
fastway = true

Or set OPENSTREAM_FASTWAY=true for the process. Restart the server after changing the setting. When enabled, a Fastway card appears in Settings; see Configuration Reference.

Connect an account

Use the Fastway username and password for your subscription. This provider does not use the JioTV mobile-number OTP flow.

Web interface

1. Open Settings and find the Fastway card.
2. Enter the Fastway username and password, then select Connect.
3. Check that the card says Connected. The header also shows a Fastway indicator while the provider is enabled and connected.

Terminal

ost fastway login

The command prompts for the username and password and saves the login in the server’s data directory. Restart a running server after a CLI login so it picks up the new credentials. To remove the saved login:

ost fastway logout

The password is kept locally because Fastway has no refresh-token endpoint; the server signs in again with the saved credentials when the provider rejects an expired access token. Do not share the data directory or its store file.

Security limitation in v1.5.0

The shipped Fastway client uses a plain-HTTP provider API (fwlivetvapp.netplus.co.in:8080) and a plain-HTTP PallyCon license endpoint. That means the Fastway username/password exchange, provider tokens and DRM-license traffic are not protected by TLS on those upstream hops. Local ost serve --tls protects the browser-to-OpenStream connection only; it does not change Fastway’s upstream URLs.

Avoid using Fastway over networks you do not trust, protect the local data directory, and do not expose Fastway credentials or provider tokens in logs or support requests. This is a transport limitation of the v1.5.0 integration, not a DRM bypass feature.

What changes while Fastway is connected

• Fastway channels replace the JioTV catalogue in Channels, the M3U playlist and the XMLTV guide. Local custom channels remain available.
• If both Fastway and JioTV+ are connected, Fastway takes priority. Disconnecting Fastway falls back to JioTV+, then to JioTV.
• Only channels the Fastway account is subscribed to are listed. A channel can still be unavailable if the provider rejects playback or the plan does not include it.
• Use Fastway only in Channels to narrow a mixed list, and look for the Fastway badge on channel tiles.
• Fastway playback is DASH. Protected channels use Widevine through the provider’s PallyCon license service; the server proxies the license request but does not decrypt or bypass DRM. See Protected playback troubleshooting.
• IPTV clients receive Fastway channels as /live/mpd/... entries with inputstream.adaptive and manifest_type=mpd.

Fastway does not use the JioTV+ unlock-code gate. It is controlled by the fastway configuration flag and the saved login.

Disconnect

Select Disconnect on the Fastway card, or run ost fastway logout. Disconnecting removes the saved Fastway login and returns the active catalogue to JioTV+ or JioTV. If the server sets disable_logout = true, the web interface hides provider disconnect controls; the CLI command still works.

Troubleshooting

• The card is missing: confirm fastway = true or OPENSTREAM_FASTWAY=true is active for the running process, then restart.
• Connect fails: check the username and password with Fastway. The server reports the provider’s message; it does not reveal whether the account has a subscription.
• Channels are missing after connecting: refresh the channel list. Only subscribed channels are shown, and the provider catalogue request may have failed temporarily.
• Playback or license errors: see Fastway troubleshooting first, then Protected playback for browser/Widevine checks.

Admin Sessions and Sign Out

The web interface uses an admin session in your browser. Signing out of the web interface does not disconnect the JioTV or JioTV+ channels provider account.

• Select Sign out in the top bar to end the current browser session.
• Sign in again with the admin password when you return.
• Admin sessions expire after 30 days.
• Changing the admin password signs out other browsers. The browser that changed it remains signed in.
• If the server is configured to disable logout, provider logout controls are hidden in Settings.

Expected result: after signing out, the sign-in page appears. Your provider account status remains as it was until you explicitly disconnect that account in Settings.

For account connection steps, see Connect Your JioTV Account and Connect JioTV+. For password change steps, see Settings.

Beta OTT provider: PlayboxTV for Android TV (playboxtv.tv.android.in 5.20.1/128)

Evidence-backed static record. No live calls. All account-shaped values redacted. The first inventory had no JADX; section 3a records the contracts recovered in the follow-up decompilation. Runtime confirmation is still required for the items listed under “still unresolved”.

1. Artifact identity (observed fact)

• File: reverse-engineering/apps/playboxtv.tv.android.in_5.20.1-128_1arch_1dpi_24lang_….apkm (APKMirror APKM v5, 33 files).
• SHA-256 (APKM): 570ca55d1d88f68a8f4dd9a7a9fd586682f8fa1dd6738b3b6623577d77f858f8
• base.apk SHA-256: 91b849571ce8286e78326bc3d9f63cd1c74bc1f7643c22e26710b2db359e97c9 (108,764,233 B); arch split split_config.armeabi_v7a.apk SHA-256: 335b8f5360af75a532991609fc3ad8ffe6204d92699a9a53e75d706ed484e9db.
• info.json: app PlayboxTV for Android TV, package playboxtv.tv.android.in, version 5.20.1 / code 128, armeabi-v7a only, 320 dpi, minSdk 24 / targetSdk 36, leanback + leanback_standalone, 24 locales.
• App class com.pairip.application.Application; launcher playboxtv.tv.in.SplashScreenActivity; Compose playboxtv.tv.in.composeUI.PlayboxTVMainActivity.

2. API bases (observed const-strings)

• 1st-party: content-consume.playboxtv.in, user-api.playboxtv.in, ugc.playboxtv.in, playboxtv-vod.multitvsolution.com (VOD thumbs).
• AWS API Gateway (ap-south-1, per-host X-API-Key): 12 hosts covering sports/EPG/lang, continue-watch, profile/avatars, Fancode, content SSO, app/IPTV customer, ZiggTV/hotel, livetv favorites/newrelease, Zee5 playableURL, user SSO verify, payments, v2.
• CloudFront catalogue: da1scxjqfmdtz.cloudfront.net (pages v1/v3/v4/v5/v6), d3veuncmu3hvmc.cloudfront.net (v1 + search v3).
• 3rd-party content: *.hotstar.com (api/apix/hf-apix/pp-apix/bifrost-api), apps/integration3/integration4.skie.tv, commerce-services.oneplay.in.

3. Endpoint paths (observed)

• Catalogue/pages: /v1/page/{movie,tv,distrotv,banner,…}, /v3/page/{livetv2,ufolivetv,sports,partner/list,premiumchannels}, content/{content}/detail, page/number/{pageName}, search/{name}, /v3/search[/livetv], content/newrelease, language_preference[/{phone}].
• Live/EPG/sports: channel/weekly_epg/, channel/epg, live/streamingURL, livetv/ads/setup/{appID}, content/livetv/{favorites,view,view/{phone}}, sports/…, sports/fancode/playable, sports/playable[Url], livesports[/all].
• Playback resolve: POST …/consume/v1/playback/resolve, …/playable-new-flow, …/consume/v1/partner-token/ltv/jio/sso; play/v5/playback/content/; v2/channel/zee5/playableURL.
• Auth/SSO: …/prod/v1/user/auth/sso/verify, …/prod/v1/content/auth/sso/verify, customer/email/login, customer/verify, api/player/login|status|verify/otp (skie.tv), play/v1/partner/login, cdcustomer/assign.
• Subs: user-api.playboxtv.in/user/subscription, /user/v1[/continue/watch…], user/{phone}/ott/{ottid}/checkOTTSubscription, customerott/customer/{phoneNo}, customer/{phone}/hasActivePacks, list/active/ott/plan/{phone}, ott/track/user.

3a. Verified wire contracts (JADX 1.5.6, base.apk)

JADX was available for this pass (it was not for the first inventory), so the service interfaces and models below are decompiled observations, not guesses. Classes: playboxtv.tv.in.api.{Api,LoginAPIService,PlayableAPIService} and the models under playboxtv.tv.in.model.

The two gateway keys above are client-embedded public constants, not account credentials; account tokens are only ever read from a successful login and are never logged or returned by this backend.

Playbox: still unresolved

• Token lifetime/refresh: the app ships no refresh endpoint; a session is replaced by signing in again.
• Whether the server uses playback/resolve or the legacy playableURL for a given account is chosen by a remote flag; both are verified and implemented as primary + fallback.
• Exact catalogue server behaviour (which of rows/livetv is populated for a given account) — the backend walks both observed lists.
• VOD/search/show models were not promoted because their playback semantics were not traced end-to-end.

4. Auth flow (observed UI + endpoints; mapping is inference)

• Mobile-number + 6-digit OTP UI (OTPRequest, LoginViewModel$getOTPfromAPI, OTPVerifyViewModel$verifyOTPAPI), email login, SSO-verify endpoints, partnerToken/authToken fields, PREF_ASSIGN_JIO_HOTSTAR_*, callUserSSO authToken.
• Inference: OTP → session token → per-partner SSO assignment (assignJioHotstar) → partner tokens for playback/resolve. No Bearer/Basic const-strings; tokens likely in body/custom headers.

5. Device identity (observed)

• AdvertisingIdClient (Ad ID), android_id, Firebase install/auth-token, FCM PlayboxTVFcmMessageListenerService. No Jio-style device-auth bootstrap.

6. Signing / keys / encryption (values redacted)

• ~13 distinct X-API-Key values (21 occurrences) = per-gateway client keys.
• assets/decrypt.js: AES-256-CBC + PBKDF2-SHA256×1989 (WebView in-app browser). Amazon Appstore assets/*.pem. Cleartext permitted globally; user certs trusted. Room/ObjectBox unencrypted. No EncryptedSharedPreferences.

7. Subscription (observed)

• CheckSubscriptionRespModal, SubscriptionHelper, ActivePack*, payment initiate/complete, Amazon IAP, per-OTT checkOTTSubscription, per-item Subscription flags. Server-side entitlement; client paywalls.

8. Catalogue / EPG / search / VOD (observed)

• Live: LiveTVAPIService, JioLiveTvPlayerActivity (Jio LTV via partner-token SSO), DistroTVActivity, UFOFanTVActivity, page/livetv2, ufolivetv.
• EPG: weekly_epg, channel/epg, EpgPlayRequest, NextEpg; embedded com/example/mytv SDK (EPGRepository, LiveRepository).
• Search: SearchAPIService, CloudFront /v3/search, per-provider subscription flags.
• VOD/shows: MoviesListAPIService, TVShowsAPIService, seasons/episodes, continue-watch + watchlist, offline downloads DB (licence/offlineDrmId).

9. Playback + DRM (observed)

• Media3 ExoPlayer (incl. Hotstar jhs.media fork + TokenRefreshInterceptor); FFmpeg/dav1d; PlayContentRespModel = {Url, Provider, Headers, …, ADS/Preroll/Midroll/Postroll/ScteMarker, Subtitle, NextEpg/NextEpisode}.
• Widevine L1/L3 config (forceL3widevine, widevineSecurityLevel), MediaDrm sessions, offline licence persistence. No license-server URL const-string (likely inside playback/resolve responses — runtime gap).

10. Refresh / retry (observed)

• Hotstar SDK token refresh + heartbeat retry; app refreshData, refreshContinueWatching; player Retry/Go-back CTAs. No app OAuth refresh-token strings.

11. Runtime gaps (must not be claimed statically)

Retrofit base-URL↔service mapping, request/response schemas, token header names, refresh cadence, actual HLS/DASH/license URLs, Jio SSO shape, catch-up (no catch-up strings found). Backend implements tolerant parsers + mock-tested contracts and marks schemas as candidates.

Beta OTT provider: Tata Play Smart

This record covers two app generations: the older com.ryzmedia.tatasky 509.0/894 installed on the A15, and the newer com.tataplay.livetv 1.0.10/101 artifact whose native Retrofit layer is recoverable.

Experimental backend status

The newer app’s verified Retrofit contracts are now implemented behind tataplay = true / OPENSTREAM_TATAPLAY=true (legacy alias JIOTV_TATAPLAY=true) as a diagnostic beta. No live Tata Play request has been made by this implementation yet.

Implemented beta routes:

• GET /api/tataplay/status
• POST /api/tataplay/login/sendOTP
• POST /api/tataplay/login/verifyOTP
• POST /api/tataplay/refresh
• POST /api/tataplay/logout
• GET /api/tataplay/catalogue-seed
• GET /api/tataplay/epg
• GET /api/tataplay/entitlement
• GET /api/tataplay/play/:id?contentType=LIVE

The beta persists a stable synthetic device identity because the server is not running inside the Android APK. OTP/session credentials remain server-side. The app’s device_details header is an opaque persisted string whose producer was not recovered; the beta therefore sends the app’s observed missing-value form (an empty string) instead of inventing an encoding. The playback diagnostic returns only booleans/counts such as whether a Widevine play URL, license URL or session ID was present; it never returns those values. Tata Play is not added to ActiveProduct, playlists, shared catalogues, /live, or the DRM/license proxy.

The channels/all contract exposes only ordered documentIds; no per-ID hydration endpoint has been proven, so catalogue-seed deliberately does not pretend they are channel objects. EPG date/timestamp encodings are also not guessed: testers must pass the app-observed date, epgStartTime and epgEndTime values.

1. Artifact identity (observed fact)

• File: reverse-engineering/apps/com.ryzmedia.tatasky_509.0-894_4arch_…​.apkm (APKMirror APKM v5, 43 inventory nodes, all hash-verified).
• SHA-256 (APKM): ab9091ab2a3bb42eeb2be2b6c6e59cc799d17b6af852618c13d433b253b90e14
• base.apk SHA-256: 93cb824c…095ac3bd0 (71,312,419 B).
• info.json: app Tata Play Smart: 500+ Channels, package com.ryzmedia.tatasky, version 509.0 / code 894, minSdk 27 / targetSdk 36, arches arm64-v8a/armeabi-v7a/x86/x86_64, 7 dpis, 24 langs, leanback capable.
• 12 DEX files (~106 MB); React Native + Hermes (libhermes.so, assets/index.android.bundle 12.2 MB, encrypted: magic 05011cc1…, zero URLs, max printable run 16 chars); CodePush OTA.

1a. Static follow-up (JADX 1.5.6, full base.apk)

The earlier pass could not run JADX. This pass decompiled all 12 DEX files and re-inspected the bundle:

• com/ryzmedia/tatasky contains only MainApplication, BuildConfig, R, UI/utility packages and SDK glue. There is no app-level Retrofit/OkHttp API class, no request builder, and no endpoint map anywhere in the DEX.
• BuildConfig exposes BASE_URL=https://tm.tapi.videoready.tv/, ACTION_NAME_CONFIG=rest-api/pub/api/v1/config, X_API_KEY, X_APP_ID=ott-app, X_APP_KEY, IRDETO_BASE_URL, CODEPUSH_SERVER_URL, BUNDLE_ID=com.hungama.tatasky. Nothing in the DEX consumes ACTION_NAME_CONFIG; it is read from JS.
• MainApplication uses DefaultReactNativeHost.getJSBundleFile() → CodePush.getJSBundleFile(), so the JS layer is the API layer.
• assets/index.android.bundle is encrypted, not Hermes bytecode: first bytes 05 01 1c c1, no c6 1f bc 03 magic anywhere in 12.2 MB, Shannon entropy 7.997 bits/byte, no readable strings, no ZIP/gzip container.
• No AES key or bundle-decryption routine is reachable from the DEX: the app classes are DexGuard-obfuscated and the only native crypto-capable libraries are stock Hermes/React Native plus packed libc2f2.so/libc7a509.so. A brute-force check of plausible keys derived from the BuildConfig values (raw/MD5/SHA-1/SHA-256, AES-CBC/ECB, several IV placements) produced no Hermes header or JS text.

Conclusion for the original com.ryzmedia.tatasky base artifact: no login, catalogue, EPG, playback, license or subscription contract is statically recoverable from its encrypted fallback bundle or DEX files. This historical conclusion does not apply to the separate com.tataplay.livetv artifact below. The diagnostic beta uses recovered contracts from that newer app and keeps Tata Play out of the shared catalogue and shared playback paths.

1b. New artifact and runtime evidence (follow-up pass)

Two different Tata Play packages are now in scope:

• Installed, logged in on the A15: com.ryzmedia.tatasky 509.0/894 (this record’s original artifact). Its encrypted fallback bundle was bypassed legally by fetching the app’s own CodePush update with the deployment key embedded in the APK. The CodePush payload is a plain ZIP containing plain Hermes bytecode (index.android.bundle, 11.8 MB), so the real JS is recoverable. It exposes the full old-app API surface (login-service, rest-api, lit-mobile-common-bff, lit-subscription-service, pas/api/v1/access/control, content-detail, etc.) under https://tm.tapi.videoready.tv/.
• New artifact in TataPlay.zip: package com.tataplay.livetv (com.tataplaylit.tv, “Tata Play Smart”), with a native Retrofit API layer and a small RN subscription SDK. This is a different app generation; it is not the installed package.

Runtime boundary on the logged-in A15 (no subscription)

Observed through the device UI, without capturing tokens:

• Session restoration and home screen: work. The account is logged in.
• Channel catalogue / home rails: work (channels and “Subscribe” prompts).
• Live TV guide / EPG: work (programme rows, channel numbers, categories).
• Search: work (e.g. DD National HD, DD Sports HD, DD India HD).
• Premium live playback: gated by the app’s own “Subscribe” UI; the account has no active pack. No subscription was purchased or activated.
• Free-to-air playback was not conclusively triggered through ADB touch input (the leanback cards did not accept injected taps); therefore no claim is made that free channels play.
• No API request/response was captured: the release package is not debuggable, the device has no root, and the app does not trust user CAs, so TLS interception would require patching the app (not done). No OTP was entered by the agent.

New app static contracts (recovered, beta-enabled)

The new com.tataplay.livetv app has a native NetworkApi with explicit Retrofit annotations on https://tm.tapi.videoready.tv/:

• POST login-service/pub/api/v3/signin/generate/otp (GenerateBody{rmn,sid})
• POST login-service/pub/api/v3/signin/validate/otp (ValidateOtpPayLoad{…})
• POST rest-api/pub/api/v3/refreshToken (RefreshTokenRequest{refreshToken,subscriberId})
• GET lit-subscription-service/api/v1/lit/getEntitlementDetails
• GET portal-search/pub/api/v1/channels/all?limit&offset
• GET lit-mobile-common-bff/api/v2/channels/guide?…
• GET pas/api/v1/access/control/{contentType}/{channelId} → PlayUrlData
• GET content-detail/pub/api/v3/catchupEpg/{channelId}?isLitEnabled=true
• POST device-management/v1/app/lit/subscriber/{subscriberId}/device

Header injection is explicit (RD0 interceptor): Authorization: bearer <KS>, appVersion: 1.0.10, platform, deviceId, device_details, deviceName, x-device-id, x-subscriber-id, x-authenticated-userid, subscriberId, sid, countryRegion, profileId. Token expiry is expiresIn (epoch millis or duration) and refresh uses the refreshToken/subscriberId body.

These contracts are enabled only inside the isolated diagnostic beta. They were recovered statically and still need runtime request/response proof. The OTP implementation follows the app’s recovered payload construction, including loginOption=OTP, the pending JWT, selectable LIT/DTH refId values, and the observed refIdMode behavior. Analytics IDs are sent as empty strings because no backend equivalent exists and the app does not prove they must be non-empty.

2. API bases (observed static strings)

• BASE_URL = https://tm.tapi.videoready.tv/ (BASE_URL_CONFIG_AKAMAI same; API_BASE_URL = ${BASE_URL} placeholder; API_TIMEOUT = 15000).
• CODEPUSH_SERVER_URL = https://cp.tapi.videoready.tv/.
• IRDETO_BASE_URL = https://tatasky-csm.live.ott.irdeto.com/ (Irdeto CSM).
• Hotstar/Bifrost stack embedded (analytics/player): api/apix/hf-apix/pp-apix/ pp-hf-apix/bifrost-api*.hotstar.com.
• No Tata Play content-endpoint paths (/live, /epg, /channel, /catalog, /search, /vod, license URL) in ~1.2 M dex strings, 859 resources, or manifest (observed absence).

3. Auth (facts + gaps)

• Facts: SmsBroadcastReceiver (OTP auto-read, Juspay SMS-handler), Facebook Login SDK, Google OAuth revoke URL, Firebase Auth/Messaging, EncryptSharedPreferences migration (tokens encrypted at rest), MoEngage setMobileNumber (RMN = user identity), deeplinks tataplay:// + https://a2uuh.app.goo.gl.
• Unknown: OTP request/verify paths, token names/expiry/refresh, device binding (all behind the encrypted JS bundle).

4. Device identity (facts)

• READ_PHONE_STATE (not required), AppsFlyer, MoEngage, Firebase (project_id=tata-sky-new-ott), Salesforce MarketingCloud, New Relic, Ad ID + AdServices. No static device-ID key names recovered.

5. Signing / hardening (facts)

• base.apk has no v1 JAR signature (v2/v3+ block present); bundle-tool stamp-cert-sha256 observed (value withheld per policy for cert digests? non-secret but omitted here).
• usesCleartextTraffic=false, allowBackup=false, extractNativeLibs=false; networkSecurityConfig declared but no network_security_config.xml in base.apk (likely in a split or stale). Pinning posture unknown.
• DexGuard-style obfuscation (o.*, libc2f2.so/libc7a509.so), Play Integrity refs, DETECT_SCREEN_RECORDING.

6–8. Subscription / catalogue / EPG / VOD

• Facts: Juspay HyperSDK (UPI/cards), CHECK_LICENSE (Play license).
• No pack/entitlement, channel-list, EPG, search, VOD, or catch-up endpoints visible statically. One lead: Hotstar JHS media SDK + live-player default_config.json → Hotstar-derived playback stack.
• Lineage string: BUNDLE_ID = com.hungama.tatasky (Hungama white-label).
• Manifest: 49 activities, 35 services, 28 receivers, 15 providers; PiP, foreground-service playback, exact-alarm + timezone/boot receivers (schedule-aware, not proof of EPG source).

9. Playback + DRM (facts + unknown)

• Facts: dual ExoPlayer (androidx.media3 + vendored com.jhs.media…), ExoDownloadServiceCore (offline), IMA + SSAI, Cast.
• DRM: Media3 DefaultDrmSession* + MediaDrm; DRM error strings; Irdeto CSM suggests multi-DRM/license via Irdeto; PlayReady AcquireLicense is an ExoPlayer constant, not proof of use.
• Unknown: Widevine license URL, key-system flow (expected behind encrypted bundle + Irdeto CSM at runtime).

10. Runtime gaps

MITM capture (device + user OTP) against tm.tapi.videoready.tv and Irdeto CSM; decrypt/unpack index.android.bundle or CodePush update; JADX setup; pinning + full cert chain. Backend implements device/token persistence, generic OTP/login/catalogue/playback/license contracts with mock tests, and marks content paths as unresolved.

Beta OTT provider: VZY (com.vzy.one.atv 1.0.253)

Evidence record for /Users/arnab/Downloads/VZY.zip. This is not the old mislabelled com.vzy.one.apk; it is a Dish/Watcho white-label OTT app.

1. Artifact identity (observed fact)

• VZY/base.apk, SHA-256 7cd4724cd030bc0566d8732eba4961d1ba7d0170503b615ac5b4c0d1ce80b275.
• package="com.vzy.one.atv", app label Vzy, versionName="1.0.253", versionCode=4101253, minSdk 24 / targetSdk 36, leanback.
• Splits: armeabi_v7a, en, xhdpi.
• Kotlin app (com.horizon.sott.*) with Kaltura PlayKit, Evergent (com.enveu.*), Kaltura OTT/Phoenix, HZ CMS, Nagra/Irdeto DRM and Broadpeak/Conviva; no React Native bundle.

2. Service identity (observed static + live)

BuildConfig identifies a Dish/Watcho white-label:

• Kaltura partner 5093, KALTURA_BASE_URL=https://5093.dsp1.ott.kaltura.com/api_v3/service/
• EPG_BASE_URL=https://cache.dsp1.ott.kaltura.com/api_v3/
• SSO_BASE_URL=https://vzy-sso.dish.watcho.com/v1/
• HZ_BASE_URL=https://hz-cms.dish.watcho.com/, PERSONALIZER_BASE_URL=https://personalizer-api.dish.watcho.com/
• DRM_BASE_URL=https://vzy-sso.dish.watcho.com/v1/, NAGARA_DRM_BASE_URL=https://drm-prod.dish.watcho.com/v1/
• KALTURA_APPLICATION_NAME=com.Kaltura.dishtv.androidTV, platform STB, API version 11.0.2.1.

3. Verified live contracts (no account, anonymous tier)

All calls below were executed anonymously and returned real data. No account credentials, OTPs or tokens were used.

Free/entitlement boundary (observed)

Of 161 channels: 72 JHSLicense/Premium, 32 Nagra/Premium, 17 Nagra/Free, 14 DynamicUrl/Premium, 12 Free/Free, 12 License/Premium, 1 DynamicUrl/LoginRequired, 1 Free/LoginRequired.

The 29 EntitlementType == "Free" channels are the implemented tier. Both Free/Free and Nagra/Free verified as clear HLS; no license request is needed for their hls_fta renditions. Premium/login-required channels are never advertised or proxied.

4. Implemented

• Anonymous DMS bootstrap + Kaltura session, persisted udid/KS, expiry-aware re-login.
• Free-tier catalogue only, vzy_<assetId> IDs, logo mapping, channel lookup, playlist inclusion.
• Live playback resolution to the shared LiveUrlOutput (HLS preferred, DASH fallback), proxied through the existing encrypted /live//render flow.
• EPG for free channels with real start/end times, integrated into XMLTV.
• Status, /api/vzy/logout, generation-guarded caches, context invalidation.

5. Disabled / unknown

• Account login (Evergent OTP, activation code/QR) is not enabled: no VZY account was supplied and no OTP was entered.
• Premium playback and Widevine/Nagra license forwarding are disabled: the anonymous session is not entitled, and the license/DRM chain was not runtime-proven. No entitlement bypass is attempted.
• Catch-up/start-over and VOD/login-only rails are not implemented.

OTT provider: com.vzy.one file → Uptodown App Store (com.uptodown 7.44)

Evidence-backed static record. No live calls. No credentials.

A different artifact, VZY.zip (com.vzy.one.atv 1.0.253), is a real Dish/Watcho OTT app and is documented in docs/ott-provider-vzy/index.md. This record describes only the original com.vzy.one.apk (Uptodown).

1. Artifact identity (observed fact)

• File: reverse-engineering/apps/com.vzy.one.apk (original tree; git-ignored).
• SHA-256: 8f8a7b2416d84d64d418dc4e194cd8ab6f4394d51651bf2e1aac47207503fd92
• Size: 15,790,385 bytes.
• Zip: 2,230 entries; classes.dex (8.7 MB) + classes2.dex (0.55 MB) + classes3.dex (7.5 MB) + classes4.dex (7.7 MB).
• DEX contains com.uptodown (24 hits) and zero com.vzy / vzy hits.
• Native libs for arm64-v8a, armeabi-v7a, x86, x86_64 (libuptodown-native.so, libutd-services-native.so + androidx libs).
• Manifest (apktool): package="com.uptodown", versionName="7.44", versionCode="744", minSdkVersion="23", targetSdkVersion="36".
• App label: Uptodown App Store; app class com.uptodown.UptodownApp; TV entry com.uptodown.tv.ui.activity.TvMainActivity.
• Conclusion: the filename is wrong. This artifact is not a com.vzy.one TV service. It is the Uptodown third-party app store.

2. API surface (static strings only, not runtime-confirmed)

• Primary: https://api.uptodown.app:443.
• Downloads: https://dw.uptodown.com/dwn/, https://www.uptodown.com:443/dwn/.
• Others: sdk.uptodown.app, t/u/www.uptodown.app, en.uptodown.com.
• v1: /v1/app/, /v1/app/search, /v1/category…, /v1/file…, /v1/home, /v1/installations, /v1/latest-updates, /v1/new-releases, /v1/top-downloads.
• v2: /v2/app/, /v2/categories…, /v2/my-wishlist, /v2/tracker/device…, /v2/user/login, /v2/user/avatars.
• Only login-shaped path: /v2/user/login (method/body unknown).

3–6. Auth / device / signing / subscription

• Auth: Google sign-in (AndroidX Credentials) + /v2/user/login; no OTP, SSO-token, refresh, or logout strings attributable to Uptodown auth.
• Device: /v2/tracker/device, /v2/tracker/identifier, /v1/installations imply install registration; field names not recovered (no JADX here).
• Signing: native NativeApiKey (getApiKeySeed/getAuthApikey) suggests a native-derived API key; derivation not analyzed.
• Subscription: none found. Only url_turbo (Uptodown Turbo web page). No entitlement, in-app-billing, or paywall strings.

7–12. Catalogue / EPG / VOD / playback / DRM

• None. Catalogue APIs are app-store listings (home, top-downloads, latest-updates, search, similar/recommended). No /epg, /channel, /live, /vod, /shows, /seasons, /episodes, catch-up, m3u8, mpd, ExoPlayer/Media3, Widevine license URL, or playback-token strings.

13. Runtime gaps

• /v2/user/login method/body, Authorization/Bearer usage, native key derivation, tracker fields, and download flow all need instrumented-device capture. Not performed.
• Tooling limit: REA JADX tools required REA_JADX_MCP_JAR (unset), so no class/method decompilation; conclusions rest on zip inventory, DEX string scans, apktool manifest/resources, and REA inspect_artifact / decode_android_resources evidence (see subagent ledger).

Implementation consequence

This service provides app distribution, not TV. The backend keeps a single provenance record in src/vzyone.rs, exposed at /api/vzyone/status (package, version, artifact SHA-256, and why it is not a provider). There is no configuration switch, no device state, no login and no channel prefix, because no runtime behaviour exists behind them.

Using OpenStream TV

Watch channels, check the guide, browse on demand and connect IPTV players.

Articles

• Find and Watch Live TV
• Read the Programme Guide
• Browse On-Demand Movies and Shows
• Use IPTV Playlists and XMLTV Guide
• Use JioTV with VLC
• Settings and Account Controls

All help centre articles.

Find and Watch Live TV

Find a channel

1. Select Channels in the top navigation.
2. Type part of a channel name in Search channels, or choose a Category or Language.
3. Turn on HD to show HD channels, JioTV+ only or Fastway only to narrow by source when those sources are present, or Show unavailable to include channels not playable for the current account.
4. Select a channel tile.

Your filters are saved in this browser. Expected result: the channel opens in the live player. A dimmed tile or subscription label means the current account may not be able to play it.

Use the player and guide

The player offers pause/resume, mute, playback quality (Auto, High, Medium, Low), picture-in-picture when your browser supports it, stream restart and fullscreen. The selected quality is remembered in this browser. The player also shows the current programme when guide data is available, followed by upcoming programme details below the video.

This v1.5.0 capture uses a JioTV+ channel and verifies the current player/guide layout. Playback for the tested JioTV+ channel was later verified manually. That single successful test does not establish that every channel will play for every account.

Expected result: playback starts and programme details appear when the channel provides guide data. Quality choices are requests; the available stream may limit the result.

Protected playback may need HTTPS, a supported browser and working Widevine support. Account rights and provider availability also affect playback. See Requirements and Network access and HTTPS.

Catch-up availability

Some channel records indicate catch-up availability, but the current Svelte web interface has no catch-up browsing or playback controls. Do not expect the programme guide to open past programmes for playback. Catch-up route support in the server does not by itself provide a supported browser workflow.

For external players, see IPTV playlists and the programme guide. For account setup, see Connect Your JioTV Account.

Read the Programme Guide

OpenStream TV shows programme information for a channel when the active provider returns a schedule. You can check what is on now and what comes next without leaving the live player.

1. Open Channels and select an available channel.
2. Find the Program guide section beside or below the player, depending on your screen size.
3. Look for the current programme marked as playing now. Future programmes appear in order, with a scheduled start time.
4. Move your pointer over the video or tap the player to show its controls and current programme details. The overlay hides after inactivity; move or tap again to bring it back.
5. If the guide is empty or says No guide for this channel, try another channel. The programme guide depends on provider data.

Expected result: You see the current show title and a list of upcoming programmes when schedule data is available. A new-programme notification appears briefly when the live schedule advances.

Can I watch a past programme?

The current Svelte interface does not offer a catch-up browser or a button to play past EPG items. Some backend routes support catch-up streams, but their presence does not establish a supported end-user workflow. The on-screen guide is for current and upcoming information.

Guide in a separate IPTV player

Enable EPG on the OpenStream TV server, then copy the EPG URL from Settings to your IPTV app. See Set up IPTV/XMLTV and Configure EPG. For incorrect times or missing shows, see Fix guide and playlist problems.

Browse On-Demand Movies and Shows

The screenshot shows the current v1.5.0 layout with JioTV+ connected and catalogue rows loaded. It verifies the catalogue UI only; title availability and playback rights still depend on the account and provider.

1. Select On demand in the top navigation.
2. Choose Home, Movies, Shows, Kids, or TV shows.
3. Browse the available rows, or search for a movie or show by name.
4. Use provider chips, when shown, to limit the visible titles to a provider.
5. Select a title. For a series, choose a season and then an episode.
6. Select the play item to open the player. Use Back to return.

Expected result: the selected title’s player opens if it is available to the connected account and provider. Catalogues and playback rights vary; an empty section or playback error can reflect account, provider, region, DRM or network limits. Fastway is a live-TV source and does not supply this on-demand catalogue.

For JioTV+ account setup, see Connect JioTV+. For protected playback requirements, see Requirements.

Use IPTV Playlists and XMLTV Guide

OpenStream TV provides an M3U playlist for channel streams and an XMLTV/EPG URL for programme schedules. The URLs are available in Settings → IPTV playlist.

For IPTV devices on your LAN, start the server with ost serve --host 0.0.0.0. After it starts, it prints a LAN playlist URL for each detected private IPv4 address. Choose the address reachable by your player. The default localhost bind only accepts connections from the server itself.

1. Open the OpenStream TV web interface and select Settings.
2. Copy the Playlist URL and add it as a network playlist in your IPTV app.
3. If the server has EPG enabled, copy the EPG URL and add it as the app’s XMLTV/guide source.
4. Refresh the playlist and guide in the IPTV app.

Expected result: the app imports the channels from the playlist and, when enabled and available, matches schedule data from the XMLTV guide. Provider availability and IPTV app support affect playback and programme matching.

Treat the playlist URL as a password: its /k/… access key grants access to the playlist. Keep it private. If it is exposed, use Make a new key in Settings, then replace the playlist URL in every IPTV app. Existing playlist URLs stop working after rotation.

The guide file is off unless server configuration enables EPG. See server configuration for the epg option and Network access and HTTPS before making the server reachable from other devices.

Use OpenStream TV with VLC

VLC can read M3U playlists. Whether a particular JioTV stream plays depends on its format, DRM, the connected account and the provider.

Open the playlist

1. Start the OpenStream TV server and sign in to your JioTV account.
2. Open OpenStream TV Settings in your browser. Find IPTV playlist and copy the complete Playlist URL.
3. Open VLC on a computer on the same trusted network as your server.
4. Choose Media → Open Network Stream on Windows/Linux or File → Open Network on macOS.
5. Paste the copied URL, then choose Play or Open. Use VLC’s playlist panel to select a channel.

Expected result: VLC imports the playlist and lets you choose a channel. Some channels may fail because the player does not support that stream’s DRM or the account cannot access the content.

Troubleshoot VLC

If VLC cannot open the playlist, confirm the OpenStream TV server is running and the address and port are reachable from the VLC device. Copy the URL from Settings again instead of typing it. A rotated access key invalidates old URLs.

If channels appear but a stream fails, try an ordinary, available channel and check the OpenStream TV server log around the failure. Test in the OpenStream TV browser player if available. VLC is not a Widevine playback solution; protected DASH content may remain unavailable.

The M3U address contains a private server access key. Never post it in forums, issue reports, or screenshots. For more help see IPTV playlist setup, Network and HTTPS, and Playback problems.

Settings and Account Controls

Open Settings from the top navigation. The page shows IPTV URLs, account connections and the admin password form.

This disposable v1.5.0 example has JioTV+ connected and JioTV disconnected. The displayed URLs point only to the local test server; your account status and private URLs will differ.

Accounts

The JioTV card shows whether the provider account is logged in. The optional JioTV+ card appears when JioTV+ is enabled and shows whether it is connected. When the server enables Fastway, a Fastway card accepts that provider’s username and password. Use each card’s login or disconnect controls to manage that provider account. See JioTV account sign-in, JioTV+ channels, and Fastway Live TV.

You can switch JioTV accounts by logging out and signing in with another number; an administrator can hide provider logout controls with a server configuration option.

Playlist and guide links

Copy the Playlist URL into a compatible IPTV app. Copy EPG for the programme guide when EPG is enabled. On a protected server these URLs contain the /k/<key>/ access-key path even if the input field is visually clipped. Make a new key invalidates old key-scoped playlist and stream links, so update every IPTV app afterward. When authentication is deliberately disabled, Settings uses unkeyed /playlist.m3u and /epg.xml.gz paths and key rotation is unavailable. See IPTV playlists and XMLTV.

Change the admin password

1. Enter the current password.
2. Enter a new password of at least eight characters.
3. Select Change password.

Expected result: Settings confirms the change. Other browser sessions are signed out; the current browser stays signed in. See Admin Sessions and Sign Out.

Server options

The web page does not expose every server setting. EPG generation, JioTV+ and Fastway availability, logout behavior, network binding and other runtime options are configured on the server. See Configuration Reference, CLI Commands, and Network access and HTTPS.

Configuration

Find command-line, TOML, network and storage options verified against the current Rust server.

Articles

• Configuration Reference
• CLI Commands and Options
• Network Access, Ports and HTTPS
• Data Files, Backups and Logs
• IPTV, EPG and Streaming Settings

All help centre articles.

Configuration Reference

OpenStream TV reads an optional TOML file and environment variables. Environment variables override the file. The Rust build only parses TOML, even though its automatic filename search also sees YAML/JSON names. A YAML or JSON file at a matching name will cause a parse error; convert it to TOML or use environment variables.

Explicit path: ost --config /path/to/openstream.toml serve. The parser also accepts ost serve --config /path/to/openstream.toml.

If --config is omitted, it searches the current working directory, in this order: openstream.toml, openstream.yml, openstream.yaml, openstream.json, legacy jiotv_go.yml, jiotv_go.yaml, jiotv_go.toml, jiotv_go.json, then config.json, config.yml, config.toml, config.yaml. Only choose a .toml filename.

Example

# openstream.toml (sample values; no credentials)
title = "Home TV"
epg = true
drm = true
tv_plus = false
fastway = false
# Beta: PlayboxTV account (OTP login). Off unless you sign in.
playbox = false
# Beta: Tata Play Smart diagnostics. Off by default.
tataplay = false
# Beta: VZY free tier (anonymous). Off unless you want its catalogue.
vzy = false
disable_auth = false
debug = false
log_to_stdout = true
# Set only if an HTTPS reverse proxy or named tunnel publishes this hostname.
# public_origin = "https://tv.example.com"
default_categories = []
default_languages = []

Save, start with ost --config ./openstream.toml serve, then open http://localhost:5001/.

Complete configuration table

Boolean environment values must be true or false in lowercase (as Rust’s parser expects). Use either the JIOTV_* environment variable or its documented OPENSTREAM_* alias where listed; the OPENSTREAM_* value takes precedence when both are set. Example: OPENSTREAM_EPG=true ost serve. If ost epg off has stored an override, that environment variable alone does not re-enable EPG; run ost epg on to replace the persisted override. Integer-list settings use JIOTV_DEFAULT_LANGUAGES=1,6.

The TOML key is tv_plus; JIOTV_TVPLUS and OPENSTREAM_TVPLUS are accepted, with OPENSTREAM_TVPLUS taking precedence. The previous TOML key extras and legacy JIOTV_EXTRAS variable are also accepted. Both JIOTV_* and OPENSTREAM_* aliases are accepted for tunnel and update tokens.

When more than one source is connected, catalogue precedence is Fastway > JioTV+ > PlayboxTV (beta) > VZY (beta) > JioTV. JioTV remains the normal fallback source. See Connect Fastway Live TV.

playbox / OPENSTREAM_PLAYBOX (legacy alias JIOTV_PLAYBOX) enables the beta PlayboxTV integration. When a PlayboxTV session is signed in it supplies the catalogue only if Fastway and JioTV+ are not connected; it takes precedence over VZY and JioTV. Its channel IDs start with pb_. EPG for PlayboxTV is not published because the client’s guide response has no programme end time.

vzy / OPENSTREAM_VZY (legacy alias JIOTV_VZY) enables the beta VZY free tier. It signs in anonymously to the Dish/Watcho Kaltura tenant, exposes only free channels (vzy_* IDs), and proxies their clear HLS/DASH. It does not implement account login, premium entitlement, or DRM license forwarding for paid channels.

tataplay / OPENSTREAM_TATAPLAY (legacy alias JIOTV_TATAPLAY) enables a deliberately isolated beta built from the recovered com.tataplay.livetv Retrofit contracts. Its routes live under /api/tataplay/*: OTP send/verify, refresh, catalogue seed, EPG, entitlement and sanitized access-control. The beta preserves Tata Play’s own entitlement decision. Shared catalogue selection, /live, DRM/license proxying and session heartbeat remain disabled until runtime testers prove those flows.

The supplied older com.vzy.one.apk is the Uptodown app store rather than a TV service; the real VZY build is com.vzy.one.atv.

For runtime listening options, see CLI commands; for protection see Network and HTTPS; for storage see Data and logs.

CLI Commands and Options

Run ost --help to see the installed binary’s command list. These commands are defined by the current Rust CLI.

All commands accept --config PATH. --skip-update-check suppresses the startup version check.

Server options

--tunnel-token is visible in the process list. Prefer OPENSTREAM_TUNNEL_TOKEN, which the guided installer and OpenWrt service use. ost autostart records current OPENSTREAM_* variables in a private environment file for systemd and Termux autostart. On other systems, persist settings in a user-owned environment file or set them in the shell that starts the server.

For manually managed proxy hostnames or named tunnels, set OPENSTREAM_PUBLIC_ORIGIN=https://tv.example.com (legacy JIOTV_PUBLIC_ORIGIN also works) or public_origin = "https://tv.example.com" in TOML. This keeps M3U stream, EPG and DRM license links HTTPS when the public hostname requests them. Saved and quick tunnel modes set the public origin automatically.

Example: ost serve --host 127.0.0.1 --port 5001 --tls. This serves HTTP on 5001 and HTTPS on 5443. When no certificate files are supplied, the server generates a self-signed certificate; browsers may show a warning until you trust it.

Avoid exposing the service publicly without strong controls. The access key and login are not a substitute for a network security plan. See Network and HTTPS.

Network Access, Ports and HTTPS

By default OpenStream TV listens on localhost:5001 so only the server can connect. A TV or phone on your home network needs an address the TV can reach.

Open the web interface on your network

1. Find your server’s private LAN address (for example, 192.168.1.20).
2. Start ost serve --host 0.0.0.0 --port 5001 on a trusted network.
3. On another device on the same LAN, visit http://192.168.1.20:5001/ with your own server address.
4. Sign in with your admin password. Ensure any local firewall permits only the devices you intend.

When the listener is bound to an IPv4 wildcard such as 0.0.0.0, v1.5.0 also prints a LAN playlist URL for each detected private IPv4 address. The option --public sets the bind host to [::], which is broader than “allow my TV” and can behave differently across operating systems. Avoid router port-forwarding for this service.

HTTPS and protected browser playback

Run ost serve --tls to add HTTPS on port 5443 while retaining the HTTP IPTV listener on 5001. Browsers may require a secure origin for DRM/Widevine or encrypted media APIs. The generated certificate is self-signed, so plan for proper trust on each viewing device or provide --tls-cert and --tls-key. Supplying certificate flags alone, without --tls, has no effect.

When you open Settings → IPTV playlist, the UI offers plain-HTTP playlist/EPG links when accessed over OpenStream TV’s HTTPS listener because some IPTV players do not trust a self-signed certificate.

Cloudflare HTTPS tunnel or reverse proxy

If Cloudflare or another trusted proxy accepts HTTPS and forwards HTTP to port 5001, set the public hostname explicitly:

OPENSTREAM_PUBLIC_ORIGIN=https://tv.example.com ost serve --host 127.0.0.1 --port 5001

Only requests whose Host matches tv.example.com then receive HTTPS links in the playlist, EPG, live-stream and DRM license URLs. Requests from LAN clients (for example 192.168.1.20:5001) continue to receive HTTP links; the direct TLS listener also retains its own HTTPS origin. The server ignores client-supplied Forwarded and X-Forwarded-* headers for URL generation. The proxy must pass the public hostname in Host and protect access to the local HTTP listener.

Run ost tunnel setup --domain example.com --subdomain tv --port 5001 with a scoped CLOUDFLARE_API_TOKEN to create a managed tunnel and save its connector token and public origin privately. Grant the token Zone Read, DNS Edit, and Cloudflare Tunnel Edit for the intended zone/account. Then start ost serve --host 127.0.0.1 --port 5001 --tunnel --tunnel-saved (use the port you supplied during setup). Quick tunnels started with --tunnel --tunnel-quick discover their temporary HTTPS origin automatically. For a manually created named tunnel using --tunnel-token or OPENSTREAM_TUNNEL_TOKEN, set OPENSTREAM_PUBLIC_ORIGIN yourself. A configured origin takes precedence over the discovered tunnel hostname.

Account and playlist security

• Keep disable_auth = false and disable_url_encryption = false.
• Store your server data directory privately. It contains sessions, login tokens and access keys.
• Never paste an /k/<key>/... playlist URL into public forums, screenshots or issue reports.
• Make a new key in Settings invalidates old IPTV links on all clients; update those clients afterwards.
• An admin password change signs other browser sessions out.
• Sign out of the web interface when using a shared browser.

The access key protects the key-scoped playlist and stream routes such as /k/<key>/...; it is not a blanket password for every HTTP path. Browser administration uses its own session/password checks, and the server also has intentionally public bootstrap/static/auth endpoints. Do not describe the access key as protecting the entire server.

Fastway has an additional upstream transport limitation in v1.5.0: its provider API and configured PallyCon license endpoint are plain http:// URLs. Enabling HTTPS on your local OpenStream TV listener does not encrypt those upstream Fastway hops. See Fastway account setup and Fastway troubleshooting.

For config values, see Configuration Reference; for lost access, see troubleshooting.

Data Files, Backups and Logs

OpenStream TV stores its access key, administrator password hash, device identity and provider session tokens in the runtime data directory. The Rust source resolves its default data directory to a per-user OpenStream TV location; an OpenWrt package can use a different configured path. Set OPENSTREAM_PATH_PREFIX (or TOML path_prefix) to choose another writable location.

Files may include:

Collect logs

If OpenStream TV is running in your terminal, inspect the output there. For a short diagnostic run you can use:

OPENSTREAM_DEBUG=true OPENSTREAM_LOG_TO_STDOUT=true ost serve

Reproduce the problem once, then read the messages locally before sharing. Redact cookies, tokens, access-key URLs, OTPs, device identifiers and private server addresses. OPENSTREAM_LOG_PATH exists in the config schema but does not currently implement file output.

For platform-specific log commands, a report template, and the complete sanitization checklist, see Collect logs and report a problem safely.

For systemd or a container, see background services and Docker maintenance.

Safe backup and restore

1. Stop OpenStream TV so files are not changing while you copy them.
2. Copy the whole configured data directory into a private location; preserve its permissions.
3. Restore that directory to the same path_prefix before starting OpenStream TV.
4. Test the admin login, account status and IPTV playlist link.
5. If restoring to another host, check network settings and rotate the playlist key if its URL may have escaped.

Never store these backups in public Git repositories. See Backup and restore.

IPTV, EPG and Streaming Settings

Most viewers can leave these settings alone. This reference is for setting up an IPTV app or troubleshooting stream delivery. The values below come from the current Rust configuration schema.

Programme guide (EPG)

By default epg = false, so the XMLTV guide is not generated automatically. To enable it, create or edit a TOML configuration file:

epg = true

You can also start OpenStream TV with the environment variable OPENSTREAM_EPG=true. Restart the server after changing the setting. The EPG endpoint is /epg.xml.gz; in Settings, copy the EPG URL shown for your installation. The command ost epg generate creates a guide, and ost epg delete removes the generated cache. The programme schedule depends on account access and upstream data.

For headless and slim installs, ost epg on stores a persistent EPG override in the OpenStream TV data directory; ost epg off reverses it. The stored override takes precedence over the config-file or environment default. On managed OpenWrt/systemd installs the command restarts OpenStream TV only when the service is already running; a stopped service stays stopped and uses the setting on its next start. Unmanaged foreground/background servers still need a manual restart. ost epg on prints the EPG URL after applying the change. On non-OpenWrt installs, replace <server-ip> with the device address and, if shown, <port> with the server port. When EPG is enabled, server startup also prints the URL directly below the M3U playlist URL.

M3U playlist and access key

The full web interface shows playlist and EPG links in Settings. A protected installation uses /k/<key>/playlist.m3u and /k/<key>/epg.xml.gz. If authentication is deliberately disabled, the paths are /playlist.m3u and /epg.xml.gz and access-key rotation is unavailable. Do not replace the full link with a guessed path; use Copy for the link supplied by your server.

If you choose Make a new key, clients with old links stop working. Copy the new URL to every IPTV app. The key belongs only to your local server; it does not change your provider subscription.

Playback options

Protected browser playback may need HTTPS and a working Widevine or other supported DRM environment. See Network and HTTPS and DRM playback errors. For a complete list of settings, see the configuration reference.

Troubleshooting

Start with the symptom that matches what you see. These steps describe the current Rust server and Svelte web app. Provider outages, account entitlements, browser support and network policy can affect results.

Before changing anything, note the app version, install type, browser or IPTV player, whether the problem affects one channel or all channels, and the exact time it happened. Check the server’s own terminal or service logs. Do not post OTPs, passwords, cookies, playlist URLs, access keys, tokens, or the private data directory. Use Collect logs and report a problem safely before attaching diagnostics.

Choose a problem

• Installation, startup, architecture, permissions and ports
• JioTV login, OTP, sessions, tokens and JioTV+
• Fastway login, catalogue, DASH and PallyCon problems
• Channels, loading, buffering and subscriptions
• HLS, DASH, DRM, Widevine, licenses and browser security
• EPG, missing channels, playlists and mode changes
• Web access, settings, memory, crashes, Docker and updates

For setup instructions see Getting started, installation guides, configuration, live TV, and IPTV playlists.

Safe first checks

1. Confirm the server is running and use the address and port configured for that installation.
2. Reload the page once and try another channel. This helps separate a single-channel issue from a server-wide issue.
3. Check Settings for JioTV, JioTV+ and EPG status. The browser UI’s admin login and the JioTV account login are separate.
4. Reproduce once, then check the server output around the failure time. Share only a short, redacted excerpt with support.
5. Avoid repeatedly requesting OTPs or changing account, proxy, TLS or firewall settings without evidence.

Further help

If the relevant article does not resolve it, provide the app version, platform/install method, browser or player and version, exact failure time/timezone, the steps to reproduce, whether other channels work, and a redacted error excerpt. Follow the safe log/report guide before posting it.

Collect logs and report a problem safely

Good reports show what failed, when it failed and the smallest log excerpt that explains it. Do not upload the OpenStream TV data directory, store_v4.toml, a full configuration dump or an unedited browser/network export.

First five minutes

Before changing settings or reinstalling anything:

1. Note the OpenStream TV version shown in Settings, or the release/build you installed.
2. Record the operating system and CPU architecture, install method (binary, installer, Docker, OpenWrt or source build), provider, and browser/IPTV player.
3. Record the exact local time and timezone when the failure occurs.
4. Write the shortest reproduction steps and whether the problem affects one channel/item or everything.
5. Reproduce the failure once, then immediately collect the surrounding server log lines. Repeated retries can hide the first useful error or trigger provider rate limits.

Keep exact error text and HTTP status codes such as 401, 403 or 502. A status code is a symptom; the nearby server log normally shows which local or upstream request failed.

Collect a fresh log

Terminal, macOS or Windows

If you normally start OpenStream TV in a terminal, stop it and run a short diagnostic session with debug output enabled. Keep your usual serve command, configuration and arguments so the diagnostic run uses the same host, TLS, ports and tunnel settings as the failing server:

OPENSTREAM_DEBUG=true OPENSTREAM_LOG_TO_STDOUT=true ost serve <your-usual-serve-arguments>

On Windows PowerShell:

$env:OPENSTREAM_DEBUG = "true"
$env:OPENSTREAM_LOG_TO_STDOUT = "true"
ost serve <your-usual-serve-arguments>

Replace the placeholder with the arguments you normally use. Do not drop options such as --host, --tls, --port, --tls-port, --config or --tunnel just to collect logs.

Reproduce the problem once and copy only the lines around that time.

Linux systemd

System-wide service:

sudo systemctl status openstream
sudo journalctl -u openstream --since "10 minutes ago"

User service:

systemctl --user status openstream
journalctl --user -u openstream --since "10 minutes ago"

Docker or Docker Compose

Docker:

docker ps --filter name=openstream
docker logs --since 10m openstream

Docker Compose:

docker compose ps openstream
docker compose logs --since 10m openstream

OpenWrt

/etc/init.d/openstream status
logread -e openstream

Do not attach /etc/config/openstream or /etc/openstream. They can contain tunnel credentials, account state and TLS material.

Sanitize before sharing

Read the excerpt yourself before posting it. Remove or replace sensitive values while keeping enough structure to correlate repeated values.

Use the same placeholder for the same value within one report, for example <TOKEN_1> every time the same token appears. Keep timestamps, HTTP status codes, component names, non-secret request paths and the original error text.

Also sanitize screenshots. Check browser address bars, QR codes, Settings pages, terminal history and notification text before uploading them.

If you are unsure whether a value grants access to an account, stream, device or server, redact it.

Never upload these files or values

• store_v4.toml or the whole OpenStream TV data directory
• /etc/config/openstream or /etc/openstream from OpenWrt
• .env files or generated service environment files
• cookies, Authorization headers, OTPs, passwords or authentication tokens
• full playlist/M3U URLs containing the access key
• browser storage, browser profiles, HAR files or network exports unless you have manually removed credentials and cookies
• TLS private keys

If support needs a specific field from one of these sources, copy only that field or the relevant redacted lines. Do not publish the original file.

What to put in a bug report

Use this structure:

OpenStream TV version/build:
OS and architecture:
Install method:
Provider:
Browser/player and version:
Exact failure time + timezone:

Steps to reproduce:
1.
2.
3.

Expected result:
Actual result:
Scope: one channel/item / multiple / all
HTTP status or visible error:

Redacted server log excerpt:
<paste only the relevant lines>

For playback failures, include the channel/item and whether it is live, catch-up, HLS or DASH/DRM, but do not include encrypted upstream URLs, license payloads or provider credentials.

See Troubleshooting OpenStream TV for symptom-specific checks and Data Files, Backups and Logs for storage details.

Fix Video Stuck on Loading

Symptoms

You select a channel but the live player keeps showing a spinner, Loading or Reconnecting, or eventually reports that the stream is unavailable.

Possible causes

The provider has no usable stream for that channel, the account is not entitled to it, the browser cannot play the required format, or the server has lost provider/network access. A DRM error can look similar before a specific message appears.

Diagnosis

1. Wait for a detailed player error, then note its exact wording.
2. Select All channels and try a different channel available to your account.
3. In Settings, verify the corresponding JioTV or JioTV+ account is connected.
4. Compare one browser with another on a secure address (HTTPS or localhost). Look at the server’s output for the failure time.

Solution

1. Reconnect a disconnected account. For a subscription label, choose a channel included in your plan.
2. If the player explicitly reports a secure-connection or Widevine problem, follow DRM playback errors.
3. For a temporary network outage, restore connectivity and select Try again. If only one channel fails, retry later.

Verification

Play a known-available channel for several minutes, then retry the original. Record which one works; one working channel does not prove all channels are available.

Further help

Provide the visible error message, app/browser version, channel source and redacted server log excerpt. Do not share stream URLs, tokens, or account details. See all playback symptoms.

Fix DRM and Widevine Playback Errors

Symptoms

A protected channel displays Protected playback unavailable, asks for a secure connection, or fails to obtain a media license.

Possible causes

The page is on LAN HTTP, the browser or device lacks a working Widevine Content Decryption Module, the provider denied the license, the account lacks subscription rights, or the server cannot reach its provider.

Diagnosis

1. Check the browser address. A plain LAN IP starting with http:// may prevent encrypted playback, while localhost is treated specially.
2. Open the same OpenStream TV server via configured HTTPS, then retry the channel.
3. Try a non-protected channel and another protected channel, if both are available to your account.
4. Note the player error and browser/device version. Check Settings account status and the server’s timestamped logs.

Solution

1. On your trusted LAN, run the server with ost serve --host 0.0.0.0 --tls or configure the equivalent TLS-enabled service.
2. Browse to https://<server-address>:5443/. A generated self-signed certificate must be trusted on that device. For routine shared access, prefer a trusted certificate.
3. Use a browser/device with a working Widevine implementation and an account that can access the channel. A successful API capability check alone does not prove usable DRM playback.
4. If the provider refused the stream or license, retry later or choose permitted content.

Verification

On the same browser and secure origin, confirm that the protected-player warning disappears and the stream actually plays. Compare with an ordinary channel to isolate the issue.

Further help

Share the exact displayed error, browser/device version, HTTPS status, and redacted logs. Do not share license responses, session tokens, encrypted stream URLs, or try to bypass DRM. For HLS and DASH specifics, read protected playback troubleshooting.

Fix JioTV OTP Login

Symptoms

The OTP never arrives, a code is rejected, or the JioTV card remains Not logged in after you finish signing in.

Possible causes

The number or code is wrong, the code expired, the provider rejected the request, the account requires another verification step, or the stored session is no longer valid.

Diagnosis

1. In Settings, check the JioTV card and whether it reports an account connection.
2. Confirm that the OTP went to the number associated with your own account. Do not post it or paste it into issue reports.
3. Check the message displayed by JioTV and the server log at that time. Do not mistake a browser admin-password prompt for provider OTP login.

Solution

1. Start a fresh sign-in through the JioTV card or run ost login otp in a terminal.
2. Enter the most recent code before it expires. Avoid requesting several codes rapidly.
3. If a session is invalid, follow the account-session guide for the available reset and reconnect actions.
4. If the provider is unavailable, wait until it accepts login again.

Verification

The JioTV card should show Logged in; then visit Channels and confirm the catalogue loads. Successful login does not guarantee access to every subscription channel.

Further help

Provide a redacted error, login method, app version, time and account status only. Never share OTP, password, cookie, token or phone number. See connect an account and account troubleshooting.

Fix JioTV+ Connection

Symptoms

JioTV+ is missing or disconnected in Settings, its channels do not appear, or JioTV+ content is unavailable after login.

Possible causes

JioTV+ integration is disabled (its default), no separate JioTV+ session is connected, the subscription lacks access, or the provider rejected the session.

Diagnosis

1. Check Settings for the JioTV+ enabled/connected status and the JioTV account status separately.
2. Verify whether the server was started with OPENSTREAM_TVPLUS=true or tv_plus = true in TOML.
3. In Channels, clear filters such as JioTV+ channels only and Show unavailable to understand which source is visible.
4. Check the exact error and server logs without exposing account credentials.

Solution

1. Enable JioTV+ in server configuration and restart if the integration is currently off.
2. Connect your own JioTV+ account in Settings or use ost tv+ login on the server.
3. Retry the current source and refresh external playlists after a successful connection.
4. If a channel needs a subscription, use an entitled account or choose other content.

Verification

Confirm the JioTV+ card shows connected and check a channel your plan permits. Treat JioTV and JioTV+ connections as separate states.

Further help

Provide the JioTV+ status, source badge, version and redacted error. Never share tokens or login codes. See connect JioTV+ and account troubleshooting.

Fix Missing or Stale Programme Guide

Symptoms

The IPTV guide is empty, shows yesterday’s shows, has incorrect programmes, or the player reports No guide for this channel.

Possible causes

EPG generation is disabled by default, provider guide data is unavailable, a source/account changed, or an IPTV player cached an old XMLTV copy.

Diagnosis

1. Check Settings for the EPG status and copy the URL that your server displays.
2. Check whether epg = true or OPENSTREAM_EPG=true is configured.
3. Compare the live player’s programme guide to the external IPTV client’s schedule.
4. Review the server output for guide-generation errors. New guide generation can take several minutes.

Solution

1. Enable EPG if you want XMLTV and restart OpenStream TV after the configuration change.
2. If generation needs a manual retry, stop a service using the same data directory before running ost epg generate.
3. Re-import or refresh the current playlist and XMLTV URLs in your IPTV application, especially after an account/JioTV+ switch.
4. If only one channel lacks programme data, the provider may not supply a schedule for it.

Verification

Confirm upcoming programme titles and times for more than one channel in the current account/source. If using an IPTV app, verify its cache refreshed.

Further help

Provide EPG-enabled status, client name/version, affected channel names and redacted generation error. Do not share private playlist keys. See EPG troubleshooting.

Fix Web Interface Not Opening

Symptoms

The browser shows Connection refused, Site cannot be reached, a timeout, or a certificate warning when opening OpenStream TV.

Possible causes

The server is stopped, the address or port is wrong, the process listens only on localhost, a firewall blocks access, or the browser is using HTTP for an HTTPS-only port.

Diagnosis

1. On the server, run ost serve in a terminal if it is not running as a service. Look for startup or port-binding errors.
2. Open http://localhost:5001/ on that same machine using the default listener.
3. For another LAN device, check whether the server was started with --host 0.0.0.0 and whether its firewall permits the chosen port.
4. When --tls is enabled, use https://<server-address>:5443/ for the HTTPS listener. Plain HTTP remains on port 5001 by default.

Solution

1. Start the server and use its configured host and port. For an occupied port, choose an unused one such as ost serve --port 5002.
2. For trusted LAN access, bind to the intended interface and allow the chosen port in the host firewall.
3. If HTTPS is enabled, use the HTTPS URL. Trust a self-signed certificate only if you control and trust this server.

Verification

Load Channels or the admin sign-in page on the server, then repeat from the target client. A page opening alone does not prove channel playback.

Further help

Share the URL’s scheme/host/port (no access key), browser error, server startup output and network topology. See network access and server troubleshooting.

Installation and startup problems

Installer reports an unsupported platform or architecture

Symptoms

The installer says the operating system or CPU is unsupported, or the downloaded program exits with an executable-format error.

Possible causes

• The release does not include a build for this operating system/CPU combination.
• A 32-bit OS is being used on a 64-bit-capable device, or the wrong release asset was selected manually.
• An Android environment is being mistaken for ordinary Linux.

Diagnosis

On Unix-like systems, check uname -s and uname -m, then compare them with the current platform table in Getting started or the platform installation guide. For Docker, inspect docker info --format '{{.Architecture}}' and confirm the image supports that architecture.

Solution

Use the installer for your platform or select a release asset that matches both OS and architecture. On Android, follow the Termux installation guide. Do not force-install an incompatible binary.

Verification

Run ost --help. It should print the command help and exit successfully. Then follow Getting started to start the server.

Further help

Include OS, architecture, install method, exact error text and the release version. See all installation guides.

Download, checksum or missing-library errors

Symptoms

The download fails, checksum verification rejects the file, startup reports a missing shared library, or the installer cannot write its destination.

Possible causes

• Interrupted download or proxy/network filtering.
• A checksum mismatch or stale/manual download from a different release.
• A package or binary intended for another system.
• An unwritable install directory or missing runtime component for a manually built binary.

Diagnosis

Retry the documented installer once and note the release and full error. If you downloaded an asset manually, compare it with the checksum published for that exact release. Check available space and the permissions of the documented install directory. Do not install arbitrary libraries suggested by an unrelated error page.

Solution

Remove only the incomplete download or partial file you created, then use the official platform instructions to download again. If using a package manager, install the matching package and let the manager resolve its declared dependencies. For a source build, follow the repository build instructions for the required toolchain.

Verification

Run ost --help, then consult the current CLI options for server flags. A successful help response confirms the executable starts; it does not confirm the server is reachable.

Further help

Share OS version, architecture, install route and exact error. See Updating before replacing an existing install.

Permission denied or state disappears after restart

Symptoms

The program cannot create files, login state is lost, or the service works interactively but not as a service/container.

Possible causes

• The service account cannot write to the configured data directory.
• The container data volume is missing or mounted at a different path.
• Interactive login and the running service use different OPENSTREAM_PATH_PREFIX values or operating-system users.

Diagnosis

Check the effective OPENSTREAM_PATH_PREFIX and the service/container mount, then verify that the same runtime user can read and write there. The default data directory is under the user’s home directory; Docker and OpenWrt may use a different location documented by their install guide.

Solution

Use one persistent data directory and grant access to the service’s own user. For Docker, keep the documented volume mounted when recreating the container. Do not recursively change ownership of broad system directories.

Verification

Restart the service/container and confirm the web UI still recognizes its admin setup and JioTV login. Check Settings for account status.

Further help

Provide install type, service user, configured data path and redacted startup error. Never send the data directory itself. See Configuration and the matching platform guide.

Address already in use or web UI unreachable

Symptoms

Startup reports that binding failed, or another device cannot open the UI.

Possible causes

• Another process already uses the configured port.
• The server is bound to loopback (localhost), which is reachable only on that machine.
• Host/container port mapping, LAN firewall, or address is wrong.
• The browser is using HTTP/HTTPS with the wrong listener.

Diagnosis

Check startup output for the actual bind address and ports. The Rust CLI defaults to localhost:5001; TLS is opt-in and defaults to port 5443 when enabled. Check the host’s process/socket tools for the selected port and inspect Docker port mappings or the platform service configuration.

Solution

Stop only the duplicate OpenStream TV instance you own, or choose an unused port using --port. To allow LAN clients, bind to the host’s LAN interface or 0.0.0.0, and allow only the needed LAN traffic in the firewall. For browser protected playback, enable TLS with --tls; see protected playback. Keep IPTV clients on the documented HTTP playlist listener.

Verification

Open the matching local URL on the server, then the LAN URL from another device. Confirm the startup address and port. Do not expose the service directly to the public internet; use a trusted private network or documented tunnel/access controls.

Further help

Share bind error, OS, install type, configured host/ports and whether local access works. See command-line options, Docker, and network settings.

JioTV login, sessions and JioTV+

OTP is not received or is rejected

Symptoms

The OTP request fails, no code arrives, or verification reports an invalid code.

Possible causes

• Number is mistyped or not in the format expected by the provider.
• Delivery is delayed, the code expired, or a newer request invalidated an earlier code.
• The provider rejected the request or verification temporarily failed.
• The JioTV+ account has multiple eligible connections and the wrong one was selected.

Diagnosis

Check the phone number, the visible app error and server output. The CLI flow is ost login otp; it prompts in the terminal. The web UI has a separate JioTV OTP flow under Settings. JioTV+ has its own connection and OTP flow, also under Settings. Confirm which account flow you are using.

Solution

Request one new OTP, wait for it, and enter that latest code promptly. For JioTV+, select the intended connection if the interface offers a choice. Do not send an OTP to anyone or include it in diagnostics. If delivery repeatedly fails, wait and contact the provider through its official support route.

Verification

Reopen Settings and confirm JioTV shows as connected. For JioTV+, confirm it is enabled and connected. Try loading the channel list.

Further help

Provide which login flow failed, approximate time, platform and redacted error. See Connect JioTV and JioTV+ guide.

Web admin password or browser session does not work

Symptoms

The web UI repeatedly asks for the admin password, rejects it, or logs out after a restart.

Possible causes

• The web admin password is being confused with the JioTV account login; they are separate.
• The service is reading a different data directory from the one used during setup.
• The password changed, which invalidates existing browser sessions.
• Browser cookies are blocked, cleared or scoped to another host/protocol.

Diagnosis

Check that you are opening the same host and protocol each time and that the running service uses the expected persistent OPENSTREAM_PATH_PREFIX. Compare the service user and data path with the setup command. Do not inspect or share the stored password hash or session secret.

Solution

Use the admin password set with ost admin password to enter the web UI. Use JioTV OTP login separately for provider channels. Keep the persistent data directory mounted and consistent across restarts. If you intentionally changed the admin password, sign in again in each browser.

Verification

Sign in, reload the page, and check Settings for provider account state. Restart only after confirming the correct persistent data path is configured.

Further help

See first launch, storage and logs, and connect JioTV.

Channels stop working after login or restart

Symptoms

The account appears signed out, live links fail after a while, or the issue began after changing hosts or restoring data.

Possible causes

• Provider credentials or session tokens need renewal or re-authentication.
• The server started with a new or different data directory.
• Provider account state changed or an upstream service is temporarily unavailable.
• Cached links from before an account switch are being reused by an external player.

Diagnosis

Check Settings account status and server logs at the time of failure. Try the same channel again from the current UI and compare with another channel. The server refreshes provider credentials as part of its playback requests; there is no supported manual token-copy or token-edit recovery procedure.

Solution

If Settings shows disconnected, use the normal JioTV OTP login again. Keep the same persistent data directory. Refresh or replace stale playlist entries through the current UI after an account or key change. If only one channel fails, continue with channel playback troubleshooting.

Verification

Confirm connected status, reload the channel list, then test one channel in the web UI. Check an IPTV player separately if that is where the failure remains.

Further help

Report whether the failure affects browser playback, IPTV, or both, plus a redacted server error and time. See IPTV playlists and data and logs.

JioTV+ is missing, disconnected or says a plan is required

Symptoms

JioTV+ channels are absent, the UI says JioTV+ is not enabled or connected, OTP fails, or playback reports that content is not in the plan.

Possible causes

• JioTV+ is disabled by configuration or explicitly locked in Settings.
• The separate JioTV+ account has not been connected.
• The account does not have the required entitlement for that item.
• The JioTV+ service or catalogue request failed upstream.

Diagnosis

In Settings, check whether JioTV+ is enabled and connected. If the page offers Unlock or Lock, note that this UI gate can override the configured default. Then check whether the channel is marked as JioTV+ and whether the message names a plan/entitlement problem. An enabled switch does not itself grant a subscription.

Solution

Enable JioTV+ in the supported configuration or unlock it in Settings, then complete the JioTV+ OTP flow separately from JioTV login. Choose the intended connection when prompted. If the UI says the account lacks a plan, check the subscription with the provider; do not try to bypass the entitlement.

Verification

Confirm Settings reports JioTV+ connected, refresh Channels, and try an item your account is entitled to. Test a regular JioTV channel to distinguish the two sources.

Further help

Provide the Settings status labels and exact redacted message. See JioTV+ guide, configuration reference, and channel playback.

Fix Fastway login and playback problems

Fastway is optional and disabled by default. In v1.5.0 it becomes the active provider when it is both enabled and connected, taking priority over JioTV+ and then JioTV. Fastway supplies live TV only.

Fastway card is missing

Symptoms

Settings has JioTV and perhaps JioTV+, but no Fastway card.

Possible causes

• fastway is still disabled.
• The environment change was made for a different service/process.
• The running binary predates Fastway support.

Diagnose and fix

1. Confirm the running release supports ost fastway login with ost --help.
2. Enable fastway = true in the TOML file, or set OPENSTREAM_FASTWAY=true for the process/service.
3. Restart the running server or service so it reloads configuration.
4. Open Settings again.

Verify: the Fastway card appears. If it does not, collect the app version, startup command/service definition and a redacted startup-log excerpt.

Login is rejected or immediately disconnects

Symptoms

The Fastway card reports a login error, ost fastway login fails, or the source does not stay connected.

Possible causes

• Username or password is wrong.
• The provider does not accept the account for this service or plan.
• The provider API is unavailable.
• A saved token expired and automatic re-login with the stored password also failed.

Diagnose and fix

1. Re-enter the Fastway username and password carefully. Fastway does not use the JioTV OTP flow.
2. Check the same account with the provider’s supported service before changing OpenStream configuration.
3. Inspect only the redacted error around the failed request. Do not post the password, access token or data-store file.
4. If credentials changed, run ost fastway logout, sign in again, then restart an already-running server after a CLI login.

Verify: Settings shows Connected and Channels loads the Fastway catalogue.

Channels are empty, missing or replaced unexpectedly

Symptoms

The channel list is empty, contains fewer channels than expected, or JioTV/JioTV+ channels disappear after Fastway connects.

Possible causes

• Fastway catalogue loading failed.
• The account is entitled to only part of the catalogue.
• Fastway is active and therefore has provider priority by design.
• A channel is a local custom channel rather than a provider channel.

Diagnose and fix

1. Check Settings → Fastway is connected.
2. Clear Fastway only, category, language, HD and search filters before judging the catalogue.
3. Remember that connected Fastway replaces the JioTV/JioTV+ provider catalogue; local custom channels remain.
4. Disconnect Fastway to verify that OpenStream falls back to JioTV+ and then JioTV.

Verify: the expected active provider’s channels appear after a refresh. Do not treat a visible channel as proof that the provider will authorize playback.

DASH stream or Widevine license fails

Symptoms

The player stays on loading, DASH fails, the browser reports DRM/Widevine trouble, or a license request fails.

Possible causes

• The provider rejected playback or the plan does not include the channel.
• The browser lacks working Widevine/Encrypted Media support or is using an insecure LAN origin.
• The Fastway CDN or PallyCon service is unavailable.
• The provider token expired and re-login failed.

Diagnose and fix

1. Try another Fastway channel to separate a single-channel problem from an account/provider-wide failure.
2. For browser playback from another device, use OpenStream HTTPS on its configured HTTPS port (default 5443) and a browser with supported Widevine. Plain http://<LAN-IP>:<configured-http-port> is not a secure browser origin; the default HTTP port is 5001.
3. Check a short redacted server-log window for fastway, DASH, license or PallyCon errors.
4. Reconnect Fastway if the logs show the provider token was rejected and re-login could not recover it.
5. If only the IPTV client fails, confirm it supports DASH and the inputstream.adaptive metadata used by the Fastway M3U entries.

Verify: the selected channel resolves and plays in a supported client. One successful channel does not prove every Fastway channel works.

Upstream HTTP security limitation

The v1.5.0 Fastway integration has a material transport limitation: its provider API is http://fwlivetvapp.netplus.co.in:8080, and its configured PallyCon license endpoint is also plain HTTP. Fastway credentials/tokens and license traffic therefore do not have TLS protection on those upstream hops. Running OpenStream TV with --tls secures your browser-to-server connection only.

Use Fastway only on a network path you trust, keep the OpenStream data directory private, and never include credentials, access tokens, playlist keys or raw store files in support material. This limitation is separate from whether Widevine itself authorizes a channel.

For general browser/DRM checks, see HLS, DASH, DRM and browser playback. For provider setup and precedence, see Connect Fastway Live TV.

Channel loading and playback

Channel list is empty, incomplete or keeps loading

Symptoms

Channels do not appear, the list is empty, or only some categories/languages are shown.

Possible causes

• The JioTV account is not connected or the channel request failed.
• Search, category, language or JioTV+-only filters hide results.
• The selected account/source does not provide those channels.
• The provider catalogue is temporarily unavailable.

Diagnosis

Check Settings for JioTV and JioTV+ status. Clear the search field and reset category, language and JioTV+-only filters in Channels. Reload once, then check server output. Compare the UI list with the account’s available content; do not assume every provider channel is available to every account.

Solution

Reconnect JioTV if disconnected. Reset the filters and choose the intended source. If only a specific source is affected, check its account status and entitlement. Wait and retry later if the upstream catalogue request failed.

Verification

Confirm a normal channel appears with filters cleared. Test one JioTV channel and one JioTV+ channel only if both accounts are configured.

Further help

Include filters used, account status labels, whether the issue affects all categories, and a redacted error. See channel navigation, account setup, and JioTV+.

A channel never starts or reports stream unavailable

Symptoms

The player stays on loading, shows “Stream unavailable from provider,” “Playback unavailable,” or the failure happens only on one channel.

Possible causes

• The provider returned no usable stream or refused the account.
• The channel is unavailable to the active account or its subscription.
• The browser cannot use a required media feature; see protected playback.
• A network/proxy interruption prevents the server from reaching the provider.

Diagnosis

Try another channel in the same source, then retry the failing channel. Check whether it is marked JioTV+ or subscription-required. Compare browser playback with an IPTV client only if that client is already configured. Check the server output for the request time. Do not infer a DRM failure from a generic loading spinner alone.

Solution

Sign in to the correct account and use content covered by that account. Retry a transient provider failure later. If all channels fail, confirm the server has outbound network access and review proxy configuration with the network guide. For browser security or Widevine messages, follow protected playback.

Verification

Test a second known-available channel, then retry the original. Confirm whether failure is limited to a channel, source, browser or all clients.

Further help

Share the visible player message, channel source/type (never the secret URL), browser/player version, time, and redacted server error. See live TV.

Playback buffers, freezes or stops

Symptoms

Video starts but repeatedly buffers, freezes, falls behind, or stops after playing briefly.

Possible causes

• Wi-Fi/LAN quality or insufficient bandwidth between viewer and server.
• Server CPU, memory, storage or container limits are under pressure.
• Provider/CDN instability or a channel-specific stream issue.
• A proxy or firewall interrupts media segments.

Diagnosis

Check whether the issue affects one device or all viewers, one channel or many, and browser UI or IPTV. Try the server from a nearby wired/LAN client if available. Observe host/container resource use during the problem and check logs for repeated request failures. Change one factor at a time.

Solution

Improve the network path or reduce competing load. Restart the app only if it has stopped responding and you can do so without disrupting other users. If one channel alone buffers, retry later and report it as a channel-specific provider issue. Avoid changing undocumented quality or proxy settings.

Verification

Watch for several minutes on the affected client and compare with another channel or client. Note whether the buffer recurs and whether host resource use spikes.

Further help

Provide server platform, client/browser, wired or Wi-Fi path, channel scope, duration and resource observations. See server maintenance and IPTV playlists.

Player says subscription required or access denied

Symptoms

The UI identifies a subscription requirement or playback is rejected by the provider.

Possible causes

• The selected channel/content needs an entitlement absent from the active account.
• JioTV and JioTV+ accounts differ; a channel belongs to the other source.
• Provider access was denied or the provider returned an account-specific refusal.

Diagnosis

Check the channel’s source badge and subscription marker, then check the corresponding account under Settings. Try a channel that does not require the same entitlement. A connected account does not guarantee access to all content.

Solution

Use the account and subscription that include the content, or choose another available channel. For JioTV+, complete its separate login and verify the plan with the provider. There is no supported entitlement bypass.

Verification

Try an entitled channel from the same account. If that works while the restricted item does not, the issue is content/account-specific.

Further help

Provide the exact message and source badge without sharing account identifiers or URLs. See account and JioTV+ troubleshooting.

HLS, DASH, DRM and browser playback

“Needs a secure connection” or playback fails on a LAN HTTP address

Symptoms

The web player says it needs a secure connection, or encrypted/protected media fails at http://<LAN-address>:5001 while the page itself opens.

Possible causes

Modern browsers restrict encrypted media APIs and some cryptographic media features to secure contexts. localhost is treated specially; a LAN IP over plain HTTP is not.

Diagnosis

Check the exact address in the browser. A plain http://localhost:5001 test can behave differently from a LAN IP. Check whether TLS was enabled for the server. The Rust CLI adds HTTPS only when started with --tls.

Solution

Enable TLS using ost serve --host 0.0.0.0 --port 5001 --tls and open https://<server-lan-address>:5443/. The generated certificate is self-signed, so accept its warning only when you trust that server, or configure a trusted certificate using both --tls-cert and --tls-key. Keep IPTV clients on the HTTP playlist listener where needed.

Verification

Confirm the browser address begins with https:// and retry the same channel. A local localhost test can help isolate secure-context behavior, but does not prove other devices can reach the server.

Further help

Share browser/version, exact non-secret address scheme/port, and visible player message. See network and HTTPS and command-line options.

Widevine or protected content is unavailable

Symptoms

The player says protected playback is unavailable, or a DASH channel fails with a Widevine/key-system error.

Possible causes

• The browser or device has no usable Widevine CDM, or its EME implementation cannot create a session.
• The browser context is not secure.
• That channel has no usable stream or the provider refused the account.
• The server has DRM disabled in configuration.

Diagnosis

First use HTTPS or localhost. Read the UI’s specific protected-playback message: the app checks whether EME is available, whether Widevine key-system access succeeds, and whether it can create a MediaKeys session. Try a current browser/device known to support Widevine and compare an ordinary, non-protected channel. Check drm / OPENSTREAM_DRM in the configuration reference; its current default is enabled.

Solution

Use a browser/device with a working Widevine implementation and a secure origin. If the server’s DRM setting was deliberately disabled, enable it and restart the server. If only one channel fails, retry later or use another available channel; provider availability cannot be fixed by changing the browser.

Verification

Confirm the UI no longer reports a missing Widevine/key-system capability and test the affected channel again. Check a second protected channel to distinguish device support from a single stream problem.

Further help

Report browser/device/version, HTTPS or localhost, exact visible error, and whether another protected channel works. Never provide license request bodies or token-bearing URLs. See channel playback.

License request fails

Symptoms

The page loads but a protected stream fails during playback, often with a license-request or HTTP status error.

Possible causes

• The browser could not reach the server’s license proxy or the server could not reach the provider.
• The account lacks access, or its provider session needs refreshing.
• The browser cannot use Widevine in this context.
• Provider license service is temporarily unavailable.

Diagnosis

Confirm HTTPS and that the error occurs on a protected channel. Try another protected channel and a regular channel. Check Settings for the matching account connection and inspect the server output at the failure time. The UI may expose a browser player error code; treat it as a clue, not proof of one specific cause.

Solution

Reconnect the relevant account if it is signed out, use an entitled channel, and retry later for a provider outage. Correct the HTTPS/browser capability issue if the app identifies one. Do not copy, replay, edit or share license requests, license responses, CDM data, or secret playback URLs.

Verification

Retry once after the relevant fix and check another protected stream. If regular HLS works but all protected channels fail, report that distinction with redacted server output.

Further help

Provide the visible error code/message, browser/device, account connection status and time. See account troubleshooting and data and logs.

HLS channel fails, including encrypted segments

Symptoms

A channel advertised as HLS does not start, stops after the manifest, or encrypted media fails in the browser.

Possible causes

• Browser secure-context restriction on a LAN HTTP page.
• Provider/CDN returned an expired or unavailable stream.
• Network, proxy or firewall blocks media requests.
• A channel has multiple stream types and one path is unavailable.

Diagnosis

Try the channel over HTTPS, then another channel. If IPTV works but browser playback fails, compare the page scheme and browser capability first. If only one channel fails, check again later and inspect server logs for that request. Do not paste or manually open encrypted upstream URLs.

Solution

Use HTTPS for the browser on LAN devices. Ensure the server has outbound connectivity to its configured provider path. Retry transient or channel-specific failures later. Keep the server’s URL protection enabled; do not disable it as a playback workaround.

Verification

Retry the channel in the browser and, separately, the configured IPTV client. Record which client succeeds and whether playback begins and continues.

Further help

Include browser/client, secure or plain HTTP, channel scope and redacted logs. See live TV, IPTV, and network and HTTPS.

EPG, playlists and source changes

EPG is missing, empty or out of date

Symptoms

The XMLTV URL fails, the guide is empty, or programme times do not match current listings.

Possible causes

• EPG generation is disabled (epg = false by default).
• The guide has not finished generating or an upstream schedule request failed.
• The current account/source context changed, requiring a fresh guide.
• The IPTV application cached an older XMLTV file or maps channel IDs differently.

Diagnosis

Check Settings for the EPG status and use the EPG URL shown there. Check the server output for generation errors. Confirm OPENSTREAM_EPG=true or epg = true if using configuration. The server refreshes its EPG cache periodically; generation can take several minutes.

Solution

Enable EPG and restart the server if needed. To explicitly regenerate from the CLI, stop the service first if it owns the same data directory, then run ost epg generate using the same config and data path. Re-import or refresh the XMLTV source in the IPTV app after generation. Do not delete the cache as a first step.

Verification

Open the EPG URL shown in Settings or import it into the client again. Confirm programmes appear for a few channels and their times are plausible for the current schedule.

Further help

Provide EPG enabled state, generation error and client name. Do not share a secret playlist URL. See IPTV playlists, configuration, and data and logs.

Playlist is empty or channels are missing

Symptoms

An M3U import succeeds but has no entries, or the IPTV app shows fewer channels than the web UI.

Possible causes

• The JioTV account is disconnected or the selected source has no channels.
• The IPTV client has an old playlist, a restrictive filter, or cached channel list.
• The wrong playlist URL or listener was copied.
• A channel is available only under a different account/source or entitlement.

Diagnosis

Copy the playlist URL from Settings → IPTV playlist. Check account status and compare the web UI’s Channels view with the IPTV app. Refresh the playlist and clear client-side group/search filters. Confirm you use the HTTP playlist URL and host/port displayed by the UI.

Solution

Reconnect the relevant provider account, import the current playlist from Settings, and refresh the IPTV client’s channel list. Select an appropriate channel source and filter. Do not hand-edit the access-key portion of the URL.

Verification

Check that the new import includes channels visible in the web UI. Test one channel; a playlist import alone does not guarantee provider playback access.

Further help

Share the player name, whether the web UI list is complete, and redacted server output. Never post the playlist URL because it contains an access key. See IPTV playlists and channel loading.

EPG channel names do not match playlist channels

Symptoms

The guide data exists but programmes do not appear beside channels in an IPTV app.

Possible causes

• The client joins XMLTV guide entries and M3U channels using IDs/names that do not match.
• The playlist or guide came from different accounts/source modes or different refresh times.
• The client retained old channel mappings.

Diagnosis

Refresh both playlist and guide from the URLs currently shown in Settings. Compare a channel’s displayed name and guide mapping in the IPTV app. Check whether JioTV+ is included in the playlist and whether the matching source/account is connected.

Solution

Re-import both resources from the same server and refresh the client’s guide mapping. If the client supports explicit XMLTV channel mapping, use its documented mapping controls. Do not alter server IDs or invent an unsupported mapping format.

Verification

Confirm at least one known channel shows programmes after the client’s next guide refresh.

Further help

Include IPTV app/version, affected channel names (no secret links), and whether both URLs were refreshed. See IPTV guide.

Channel list changes after switching account or JioTV+ mode

Symptoms

Channels or EPG entries disappear or change after JioTV login/logout, JioTV+ login/logout, or locking JioTV+.

Possible causes

• The active source catalogue changed with the account or JioTV+ state.
• The IPTV playlist or guide has not been refreshed.
• The selected filter hides the newly active set.

Diagnosis

Check Settings connection states and the Channels filters. The app combines available sources according to current login/configuration; switching an account invalidates account-specific cached data and triggers EPG regeneration when EPG is enabled.

Solution

Confirm the intended account is connected and JioTV+ is enabled/unlocked if required. Refresh Channels, then refresh the M3U and XMLTV data in each IPTV client. If the change is unexpected, restart only after checking logs and persistent state.

Verification

Confirm source status and channel list in the web UI, then refresh the IPTV client and check a channel from the intended source.

Further help

Report which source was changed, current Settings labels and which view is stale. See account and JioTV+ troubleshooting, JioTV+ guide, and IPTV playlists.

Web access, stability and maintenance

Web UI does not open or Settings/API actions fail

Symptoms

The address times out, the page is blank, login loops, or controls in Settings fail.

Possible causes

• Server is stopped, listening on another address/port, or bound only to localhost.
• The full web UI is not included in a slim/headless build.
• Browser is using the wrong HTTP/HTTPS listener, or the connection is blocked by a firewall.
• A stale browser session or blocked cookie prevents admin access.

Diagnosis

Check the server’s startup output and use the exact address for its listener. Test from the server itself, then from a LAN device. Check Settings only after signing in with the web admin password. If the page shell loads but an action fails, note the action and visible message and inspect redacted server output. Confirm whether the installation is full or slim.

Solution

Start the server with the intended LAN bind address and port, and permit that traffic on the trusted LAN. Use the full build for the web UI. Sign in again using the admin password and the same hostname/protocol. For account settings, use JioTV or JioTV+ OTP as appropriate; these are separate from the admin login.

Verification

Open the UI locally and from the intended LAN client, sign in, then check Settings account and EPG status. Verify an action by its resulting status rather than by the button response alone.

Further help

Include install type, full/slim variant, URL scheme and port (omit any key path), bind address and redacted error. See network access, first launch, and account troubleshooting.

Memory use is high or the server becomes slow

Symptoms

The host reports high memory use, the UI becomes slow, or the process is terminated under load.

Possible causes

• Several active viewers or large concurrent media requests increase workload.
• The host or container has a low memory limit or is under pressure from other services.
• Repeated provider/network errors cause retries or slow requests.
• The symptom is attributed to OpenStream TV without checking total host/container use.

Diagnosis

Measure the process and overall host/container resource use while the issue occurs. Compare idle and active playback, and note viewer count and whether one channel or all channels are involved. Check system/container logs for an out-of-memory kill. The current web Settings screen does not provide a memory-tuning control.

Solution

Reduce simultaneous streams or competing workload, or allocate appropriate capacity to the service. Fix a confirmed network/provider failure separately. Avoid changing undocumented cache or memory settings; no generic cache-clear command is a supported memory fix.

Verification

Observe resource use during the same workload after the adjustment. Confirm the process stays running and the UI responds while testing playback.

Further help

Provide platform, container memory limit, observed process/host memory, active viewer count, and whether the process was killed. Never include private data files. See Docker guide and logs.

Server crashes, exits or restarts unexpectedly

Symptoms

The process exits, a service repeatedly restarts, or the UI becomes unavailable after a playback or account action.

Possible causes

• Invalid command/configuration, unavailable port or unwritable data path.
• Host/container memory pressure or service-manager restart policy.
• A runtime error or external process termination.

Diagnosis

Capture the process exit status and a short redacted server/service log around the event. Check whether the server was started interactively, through systemd/procd, or in Docker. Check host resource and service-manager status. If it is reproducible, record the specific action and whether one channel triggers it.

Solution

Correct a confirmed port, config or directory permission issue. For a service, use that platform’s documented status and log commands; for Docker, inspect the container logs and exit state. Restart only after preserving the useful error output. Do not remove the data directory as a crash workaround.

Verification

Start the same installation again and confirm it remains up. Repeat the reproducing action once while watching logs and resource use.

Further help

Provide version, platform, run method, exit status, reproduction steps and redacted logs. See storage and logs, background services, and Docker maintenance.

Docker container starts but cannot be reached or loses state

Symptoms

The container is running but the UI is unreachable, browser playback fails, or login/settings disappear after recreation.

Possible causes

• Required host ports were not published or the process binds to the wrong interface.
• HTTPS port 5443 was not published for secure browser playback.
• The persistent data volume is absent, mounted at the wrong container path, or changed during recreation.
• The image architecture or full/slim variant does not match the intended use.

Diagnosis

Check docker ps for status and published ports, then docker logs openstream for startup output. Check the container’s volume mapping and that it persists at /app/.openstream-tv for the documented image. Compare the image variant with the web UI requirement. Use the LAN address of the Docker host, not the container’s loopback address.

Solution

Recreate with the documented HTTP mapping (5001:5001), HTTPS mapping (5443:5443) when browser protected playback is needed, and the same persistent data volume. Do not remove the volume while recreating. For a custom command or certificate, follow the Docker installation guide.

Verification

Check the published ports, open the host’s HTTPS address from a LAN device, and confirm Settings still shows the saved account state after a controlled container restart.

Further help

Share image tag/variant, redacted docker ps port mapping, volume destination, container exit state and short logs. Omit environment values and playlist URLs. See Docker installation, network settings, and data files.

Update fails or the service still runs the old version

Symptoms

ost update fails, reports an unavailable release, or the version does not change after an update.

Possible causes

• Network/API access to the release service failed or the requested version is unavailable.
• The install directory is not writable by the user running the updater.
• A service manager or container is still running its existing process/image.
• The installation is an OS package and should be updated by its package manager.

Diagnosis

Check the exact updater message, current ost --help/version output, install method and permissions on the executable directory. Check whether the process needs a service restart. For Docker, compare the running image ID/tag with the image you pulled. On OpenWrt, identify whether the app came from apk or opkg.

Solution

For a manually installed binary, run ost update with a user who can update that binary, then restart the service as indicated. For Docker, pull and recreate the container with the same data volume. For OpenWrt, update through the package manager rather than the built-in binary updater. Do not run platform installers over an existing managed service unless its guide directs you to.

Verification

Check the installed version after restart/recreation and verify Settings/account state and one channel. For Docker, confirm the new image is running and the persistent volume remains attached.

Further help

Provide install type, version before/after, exact redacted error and whether the service restarted. See Updating, Docker, and platform installation guides.

Maintenance

Update safely, preserve data and inspect your running server.

Articles

• How to Update OpenStream TV
• Back Up and Restore OpenStream TV
• Run OpenStream TV as a Background Service
• Docker Updates, Backups and Logs
• Maintain OpenStream TV on OpenWrt
• Uninstall OpenStream TV Safely

All help centre articles.

How to Update OpenStream TV

Before updating, note how OpenStream TV was installed and make a private backup of its data. Your login sessions, admin password, access keys and TLS files live in the data directory, separately from the binary.

Standalone Linux, macOS, Windows or Termux

1. Check the version shown in Settings or ost --help for available commands.
2. Stop the running foreground process or service. Record how it was started so you can use the same settings later.
3. Run ost update to fetch a matching release and verify its checksum. To choose a version, use ost update --version v1.5.0 (replace with the release you intend to install).
4. Restart OpenStream TV using your original command or service manager. On a systemd service, run sudo systemctl restart openstream (or systemctl --user restart openstream for a user service).
5. Open the app and check the version and whether Channels and Settings load.

Expected result: the new version runs with the existing configuration and account state. The updater needs access to its release source; private releases may require OPENSTREAM_UPDATE_TOKEN configured privately.

Docker

Pull the image used by your deployment and recreate the container using its existing environment and persistent volume. See Docker maintenance. Recreating a container without its prior volume can make data appear lost.

OpenWrt

Use the OpenWrt package installer or package manager to update the package, then check the procd service. The in-app ost update command is not intended to replace a package-managed binary. See OpenWrt maintenance.

If an update fails

Keep your original data backup. Collect the install method, exact version, error and relevant redacted logs. Avoid deleting data to fix an update. See update troubleshooting and uninstall safely.

Back up and restore OpenStream TV

OpenStream TV’s data directory can contain provider sessions, the admin password hash, IPTV access key, device identity and TLS private key. Treat a backup as secret. Do not upload it to a public repository or share it in support logs.

Find the data directory

The default is under the account’s home directory. OPENSTREAM_PATH_PREFIX or the path_prefix configuration setting can change it. OpenWrt uses /etc/openstream; Docker stores it in /app/.openstream-tv inside the container, usually backed by a named volume. See Data files, backups and logs.

Back up

Stop the server first so state files do not change during the copy. Use the relevant service or container controls, then copy the entire configured data directory to private storage while preserving file permissions. On OpenWrt, include both /etc/openstream and /etc/config/openstream. For Docker, back up the mounted volume while the container is stopped. Store backups encrypted or in a location accessible only to you.

Restore

Stop OpenStream TV, restore the complete directory and its permissions, and ensure the service uses the same OPENSTREAM_PATH_PREFIX. On OpenWrt restore both the application data and UCI configuration. Start the service and confirm that admin login, provider account status, TLS access and playlist links work. Rotate the IPTV access key if its URL may have been exposed.

Run OpenStream TV as a background service

ost autostart supports Linux systems running systemd and Termux. OpenWrt uses its package-managed procd service. Windows and macOS do not have a service installer in this project; run OpenStream TV in a terminal there.

Linux with systemd

Run as your normal user to create a user service, or with sudo to create a system-wide service. Include the server arguments you need:

sudo env OPENSTREAM_PATH_PREFIX=/var/lib/openstream ost autostart --args "--host 0.0.0.0 --port 5001 --tls"

For a user service, use ost autostart --args "--host 0.0.0.0 --tls". The command enables and starts the service. A user service may need lingering enabled to run at boot without an active login; the command prints the appropriate hint.

The guided installer calls this command after sign-in, which is how the account and tunnel choices reach the service: ost autostart copies the current OPENSTREAM_* environment into the generated environment file, including OPENSTREAM_TUNNEL_TOKEN.

Check status and logs:

sudo systemctl status openstream
sudo journalctl -u openstream -f

For a user service, add --user to systemctl and run journalctl --user -u openstream -f. Remove the service with ost autostart remove under the same account that installed it. The generated environment file may contain secrets; keep its permissions private.

Termux

ost autostart adds a marked command to Termux’s bash.bashrc to start OpenStream TV in the background when a shell opens. Remove it with ost autostart remove. Android power management can still stop background work.

OpenWrt

Use /etc/init.d/openstream start|stop|restart|enable|disable to control the package service. Read its output with logread -e openstream. Configuration is in /etc/config/openstream; commit UCI changes before restarting.

Docker updates, backups and logs

The container writes persistent state to /app/.openstream-tv. Keep the named volume mounted whenever you recreate the container; it holds login state, settings and the self-signed TLS certificate.

Logs and status

docker ps --filter name=openstream
docker logs -f openstream

Stop the container with docker stop openstream. Start it again with docker start openstream.

Update

Pull the new image, remove the old container, and recreate it using the same run options and named volume:

docker pull ghcr.io/wpfyorg/openstream-tv:latest
docker stop openstream
docker rm openstream

Then rerun the docker run command from the Docker installation guide, retaining -v openstream-data:/app/.openstream-tv and any ports or environment settings you had configured.

Back up and restore

Stop the container before backing up. For a named volume called openstream-data, an archive can be made with a temporary helper container:

docker run --rm -v openstream-data:/data -v "$PWD:/backup" alpine \
  tar -czf /backup/openstream-data.tar.gz -C /data .

Keep the archive private. To restore, stop OpenStream TV, extract the archive into the same volume, then start or recreate the container. Confirm the volume name before running volume commands; removing a volume deletes its contents.

Uninstall

Stop and remove the container with docker stop openstream && docker rm openstream. Remove the image with docker image rm ghcr.io/wpfyorg/openstream-tv:latest if wanted. Keep openstream-data for a later reinstall. Remove the volume only when you intend to erase all saved settings and credentials.

Maintain OpenStream TV on OpenWrt

Update

Run the OpenWrt installer again. It downloads the package for the detected package manager and architecture, verifies its checksum, then updates through apk or opkg. Do not run ost update on a package installation.

Service and logs

/etc/init.d/openstream status
/etc/init.d/openstream restart
logread -e openstream

Boot startup is controlled by /etc/init.d/openstream enable and disable. The service configuration is /etc/config/openstream; after UCI edits, use uci commit openstream and restart the service.

Back up and uninstall

Stop the service and privately copy /etc/openstream and /etc/config/openstream. These contain credentials, TLS key material and settings. Package removal with apk del openstream or opkg remove openstream preserves these paths. Use openstream-slim in the removal command if that is the installed package.

To erase OpenStream TV data after removing the package, separately delete /etc/openstream and /etc/config/openstream only after confirming that you no longer need their contents.

Uninstall OpenStream TV Safely

This page covers removal. For upgrades, use How to Update OpenStream TV.

Before uninstalling, decide whether to keep the OpenStream TV data directory. It contains saved provider sessions, the admin password hash, the access key and TLS files. Make a private backup if you may reinstall later.

Linux, macOS and other standalone binaries

1. Stop the running OpenStream TV process.
2. If you installed autostart on Linux or Termux, remove it with ost autostart remove using the same operating-system user that created it.
3. Delete only the ost executable from the directory where you installed it, such as /usr/local/bin/ost or $HOME/.local/bin/ost.
4. Keep the data directory unless you deliberately want to remove saved accounts and server secrets.

If a systemd service was created for OpenStream TV, ost autostart remove removes the service definition installed by OpenStream TV. Run it with the same privilege level used during setup.

Windows

1. Stop the server window or process.
2. Delete ost.exe from its install directory. The PowerShell installer defaults to %LOCALAPPDATA%\Programs\OpenStream TV unless you selected another location.
3. Remove that directory from your user PATH if it is no longer needed.
4. Keep the data directory if you may reinstall.

The project does not install a native Windows background service, so remove any third-party service wrapper separately if you configured one yourself.

Termux

Run ost autostart remove if you enabled Termux autostart, stop the server, then delete the ost executable from $PREFIX/bin. Android may keep Termux files after the app closes; remove the OpenStream TV data directory separately only if you want to erase saved state.

OpenWrt

Remove the installed package with the package manager used by the router:

apk del openstream
# or
opkg remove openstream

Use openstream-slim instead if that is the installed package. Package removal preserves /etc/openstream and /etc/config/openstream; back them up or delete them separately only when you intend to erase the configuration and saved account state. See OpenWrt maintenance.

Docker or Compose

Stop and remove the container, then remove its image if desired. Keep the persistent volume if you want to preserve configuration and account state. Delete the volume only when you intend to erase that data. See Docker maintenance for the matching commands.

Verify removal

After removal, ost --help should no longer resolve from the removed install location, and the previous OpenStream TV server ports should no longer be listening unless another copy is running. If the command still resolves, check command -v ost on Unix-like systems or Get-Command ost in PowerShell for another installation.

Removing the executable does not automatically erase OpenStream TV data. Review data, backups and logs before deleting any saved state.