Access Codes and HMAC Keys

The XUI.live panel has no fixed login URL. Every way in sits behind an access code — an unguessable path segment you create, scope and revoke — so the admin login simply does not exist at an address an attacker can guess.

Open Access Codes.

Five doors

Each code has a type, and the type is the door it opens:

Codes must be at least 8 characters (the Ministra type is exempt — device portals have their own constraints). Beyond the type, each code carries two restrictions:

• Groups — which account groups may enter through this door.
• IP whitelist — optionally, which addresses may use it at all.

Separate concerns get separate codes: one for your admins with an IP whitelist, one for resellers, one per API integration — so revoking a partner’s door never touches yours. Lost every admin code? The CLI rescue recreates one from the shell.

HMAC keys

For sharing a stream outside the subscription system, HMAC keys sign time-limited URLs: a named key produces links to a stream or movie that expire on schedule — access that stops existing, rather than credentials that must be revoked. Keys live on their own screen and drive embeds, previews and partner hand-offs.

Access codes guard the doors; what happens behind them is logged, monitored and alertable — the dashboard and notifications close the loop.