Web player for your website

Castreon has a ready-made web player that you put on your website with one line of code. Viewers watch the channel straight in the page, without an app, and the player carries your brand: your logo, your colour, the language you choose. The Castreon name never appears.

What viewers get:

• quality — automatic, by connection, or chosen by hand when the channel has several qualities;
• audio tracks and subtitles, when the channel has them;
• the TV guide: what is on now and what comes next, from the channel's EPG;
• full screen, picture in picture, AirPlay (Safari) and Chromecast (Chrome);
• start automatically, muted, with a Turn sound on button.

Available from Castreon 1.5.0, in all plans, the free trial included.

Quick start

1. Open the channel and go to the Player tab.
2. Under Who can watch the channel in the player, choose the protection (see below) and click Save.
3. Under Embed code, copy the <iframe> code and paste it into your web page.
4. Click Open preview to see the player exactly as viewers see it.

The player fills the width of the page and keeps the 16:9 format by itself. The menu with qualities, audio and subtitles appears only when the channel has something to choose from.

Who can watch: three protection modes

Allowed websites only (default)

The player starts only when it is embedded on your websites. Write the domains under Allowed websites, one per line:

• tv.example.com — exactly that address;
• *.example.com — every subdomain (example.com itself is added on a separate line).

Opened directly, or put on another website, the player shows a message and plays nothing. Your browser tells the player which page embeds it, and the player tells browsers where it may be shown. The preview in the panel always works.

Keep the referrerpolicy attribute from the code: without it, some websites hide their address and the player refuses to start.

Good for: online TV on your own website.

Signed link

For paid content and subscribers. Your website's server signs every link with the channel secret and gives it an expiry. Without a valid signature, or after the expiry, the player does not start.

The signature is HMAC-SHA256 over channel|expiry (the expiry in Unix seconds), written in hexadecimal. The link becomes:

https://tv.example.com/play/my-channel?exp=<expiry>&sig=<signature>

Example in PHP:

<?php
$secret = getenv('CASTREON_PLAYER_SECRET'); // the channel secret, from the Castreon panel
$slug   = 'my-channel';
$exp    = time() + 6 * 3600;                // the link is valid for 6 hours
$sig    = hash_hmac('sha256', "$slug|$exp", $secret);
$src    = "https://tv.example.com/play/$slug?exp=$exp&sig=$sig";
?>
<iframe src="<?= htmlspecialchars($src) ?>" allow="autoplay; fullscreen; picture-in-picture; encrypted-media"
        style="width:100%;aspect-ratio:16/9;border:0"></iframe>

Example in Node.js:

const crypto = require('crypto')
const secret = process.env.CASTREON_PLAYER_SECRET // the channel secret, from the Castreon panel
const slug = 'my-channel'
const exp = Math.floor(Date.now() / 1000) + 6 * 3600 // the link is valid for 6 hours
const sig = crypto.createHmac('sha256', secret).update(`${slug}|${exp}`).digest('hex')
const src = `https://tv.example.com/play/${slug}?exp=${exp}&sig=${sig}`

The Player tab shows the same examples with your channel and address already filled in.

• The secret stays only on your website's server, never in the page. In the tab: Show, Copy, New secret. A new secret stops all links signed with the old one.
• Expiry: at most 31 days.
• Tied to the viewer's IP (optional): sign channel|expiry|ip and add &ip=<address> to the link. The link then works only from that address.

Public

Anyone with the link or the code can watch the channel, on any website.

The playback token: why a copied address does not work

In every mode, the player does not use the channel's /live/… address. It receives a playback token valid for a few hours, which it renews by itself while it plays. With a signed link, the token never lasts longer than the link. An address copied from the browser stops working after a few hours; with a link tied to the viewer's IP, it does not work from another address at all.

The /live/… addresses for apps and set-top boxes stay as they are, with their IP address restrictions. If a channel should be watched only through the player, restrict /live/… with Allowed addresses: the player does not use those lists, so it keeps working.

Your brand

In Settings → Web player:

• Accent colour — the play button, the progress bar, “Live”, written as #rrggbb;
• Logo — PNG with a transparent background (recommended) or JPEG, at most 1 MB and 2000 × 2000 px;
• Logo corner — top right (default), top left, bottom right or bottom left.

The brand applies to the player on every channel.

Player language

The player’s texts (“Live”, “Next”, “Turn sound on”, the messages for viewers) exist in English, Romanian, German, Italian and Spanish.

• Settings → Web player → Player language: Automatic (each viewer's browser language, the default) or a fixed language.
• Player tab of a channel: as in Settings, or another language for that channel only.
• Websites in several languages: add ?lang=de (or en, ro, it, es) to the address in the embed code. The address wins over the settings.

Automatic start

Turn on Start automatically, muted above the embed code: ?autoplay=1 is added to the address. Browsers allow automatic start only without sound, so the viewer gets a Turn sound on button.

Clips

A clip from the archive, from the Library or recorded now plays in the same player, with a seek bar and the brand and language set here. A clip's viewing link has the same protection modes — see Clips.

HTTPS

A website on HTTPS can only show a player that is also on HTTPS: browsers block an HTTP player inside an HTTPS page, and the frame stays empty. From Castreon 1.5.1 the server can serve HTTPS itself: turn it on in Settings → HTTPS with a certificate issued by an authority for the server’s domain (simplest: Automatic Let's Encrypt, directly from Castreon) — browsers do not accept the server’s own certificate. Then write the HTTPS address, with https:// and the port, in Public domain under Settings → Instance; the embed code uses it by itself. A reverse proxy or a CDN with a certificate in front of the server still works too — see Direct HTTPS in Castreon and pinned sources and M3U export and public domain.

When it does not work

• The frame stays empty — the website is on HTTPS and the player on HTTP (see above).
• “This player can only be watched on the broadcaster’s website.” — the domain is missing from Allowed websites. Check the address with and without www, and the referrerpolicy attribute in the code.
• “This link is not valid.” — the signature does not match: another secret (after New secret), another channel, or the fields in another order (channel|expiry, then |ip).
• “This link has expired.” — the expiry has passed. Check the clock on your website's server.
• “This channel is not available.” — the channel is stopped, or the address has a wrong channel name.