Build plugins for Panelr.

What is a plugin?

A Panelr plugin is a PHP class that connects a Panelr installation to an IPTV panel's API. Every IPTV provider uses a panel to manage their streams and subscribers — XtreamUI, custom panels, proprietary systems. Panelr is panel-agnostic by design: instead of building native support for every panel that exists, Panelr uses plugins to bridge that gap.

When a provider installs your plugin, Panelr can automatically create lines, renew subscriptions, sync products, update bouquets, and manage subscribers — all through your panel's API, without the provider ever having to log in manually.

How it works

The full lifecycle from development to a client's running installation:

1. 1You build a PHP plugin class implementing PanelPluginInterface and upload it to your developer account at cloud.panelr.app.
2. 2Panelr scans your file automatically — checking for syntax errors, security violations, and interface compliance.
3. 3A client gives you their Installation ID from their Panelr dashboard.
4. 4You sign the plugin for that installation in cloud.panelr.app — Panelr generates a signed ZIP locked to that Installation ID.
5. 5The client installs the signed ZIP into their Panelr installation. Panelr verifies the cryptographic signature and file integrity on install.
6. 6The client configures the plugin with their panel credentials. Panelr uses your plugin to automate their entire operation.

Getting started

Developer account

To build and distribute Panelr plugins you need a developer account. Login to your exsting Panelr Cloud account at cloud.panelr.app and enable developer access from your account settings. Once enabled, you'll have access to the My Plugins section where you can upload, manage, and sign your plugins.

Plugin skeleton

Create a new PHP file named after your class — for example MyPanelPlugin.php. The filename must match the class name exactly.

<?php

class MyPanelPlugin implements PanelPluginInterface
{
    private array $config = [];

    public function getName(): string
    {
        return 'My Panel Plugin';
    }

    public function getVersion(): string
    {
        return '1.0.0';
    }

    public function getCapabilities(): array
    {
        return ['products', 'activations', 'bouquets'];
    }

    public function getRequiredConfigFields(): array
    {
        return [
            [
                'key'         => 'api_url',
                'label'       => 'Panel API URL',
                'type'        => 'url',
                'required'    => true,
                'default'     => '',
                'description' => 'Base URL of your panel API',
            ],
            [
                'key'         => 'api_key',
                'label'       => 'API Key',
                'type'        => 'password',
                'required'    => true,
                'default'     => '',
                'description' => 'Your panel API key',
            ],
        ];
    }

    public function configure(array $config): void
    {
        $this->config = $config;
    }

    public function testConnection(): array
    {
        $ch = curl_init($this->config['api_url'] . '/ping');
        curl_setopt_array($ch, [
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_HTTPHEADER     => ['X-Api-Key: ' . $this->config['api_key']],
            CURLOPT_TIMEOUT        => 10,
        ]);
        $response = curl_exec($ch);
        $code     = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);

        return $code === 200
            ? ['success' => true,  'message' => 'Connected successfully.']
            : ['success' => false, 'message' => 'Could not connect to panel.'];
    }

    // Implement remaining interface methods...
}

Plugin structure

When you sign a plugin for a client, Panelr packages it into a ZIP containing three files. You only provide the PHP file — the other two are generated automatically.

• {ClassName}.php — your plugin class file
• plugin.json — manifest generated from your plugin settings
• license.json — cryptographic license locked to the target installation

Naming rules

• Your PHP filename must match your class name exactly: MyPanelPlugin.php → class MyPanelPlugin
• Class names must be unique across installed plugins
• One class per file — multiple class definitions will fail the security scan

Interface reference

Every plugin must implement all methods of PanelPluginInterface. Every method returns an array containing at minimum a success key. Methods gated behind a capability are only called when that capability is declared in getCapabilities() — but all methods must still be present in your class.

Identity

Configuration

Connection

['success' => true,  'message' => 'Connected successfully.']
['success' => false, 'message' => 'Could not connect to panel.']

Activations

['success' => true, 'data' => [
    'panel_user_id'   => '1234',
    'xtream_username' => 'abc123',
    'xtream_password' => 'xyz789',
    'expiration_date' => '2027-01-01 00:00:00',
    'xtream_host'     => 'http://panel.example.com:8080', // optional
    'm3u_url'         => 'http://...',                    // optional
]]

['success' => true, 'data' => [
    'expiration_date' => '2028-01-01 00:00:00',
]]

Products

Bouquets

Other

Capabilities

Declare only the capabilities your panel actually supports. Panelr uses this to show or hide admin controls — undeclared capabilities are never displayed.

Security rules

Plugin files are scanned automatically on upload. Files that violate these rules are rejected before storage.

Allowed

• curl_* functions for HTTP requests to your panel API
• json_encode, json_decode, urlencode, urldecode
• date, time, strtotime, date_create
• All standard string, array, and math functions

Blocked

• System execution — exec, shell_exec, system, passthru, proc_open
• Code evaluation — eval, assert, create_function
• File system access — fopen, fwrite, file_put_contents, file_get_contents
• Database access — mysqli_*, new PDO
• File includes — include, require
• Superglobals — $_GET, $_POST, $_SERVER, $_SESSION
• Output — echo, print, var_dump
• Obfuscation — base64_decode+eval chains, variable variables

Plugin Management

Everything after your plugin code is written happens in Panelr Cloud at cloud.panelr.app. This section walks through the full workflow — uploading your plugin, managing it over time, signing it for individual clients, and automating signing via the API.

Managing Plugins

Everything after your plugin code is written happens in Panelr Cloud at cloud.panelr.app. This section walks through the full workflow — uploading your plugin, managing it over time, signing it for individual clients, and automating signing via the API.

Each plugin row shows:

• Plugin name and class — the display name you set, plus the PHP class name and version badge.
• Capabilities — the capabilities declared in your plugin, shown as badges. These determine which Panelr features your plugin enables for clients.
• Installs — the number of unique installations currently running your plugin.
• Added / Last signed — when the plugin was first uploaded and when you last issued a signed package.
• Actions — sign the plugin for a new client, edit plugin details, download your source file, or delete the plugin entirely.

Adding Plugins

Click Add Plugin from the My Plugins page to open the upload form. Fill in the plugin metadata and upload your PHP file — Panelr scans it immediately.

The form fields:

• Plugin Name — the display name shown to you and your clients. Doesn't need to match the class name.
• Min App Version — the minimum Panelr version required. Clients on older versions won't be able to install your plugin. Set this to the version you developed against.
• Description — a short summary shown alongside your plugin. Optional but recommended.
• Author — your name or company. Shown in plugin details on the client's side.
• Capabilities — check every capability your plugin supports. These must match what your getCapabilities() method returns — Panelr validates this during the scan.
• Plugin File (.php) — your PHP class file. Must implement PanelPluginInterface. The file is scanned for security violations and interface compliance before it's accepted.

Click Upload & Scan to submit. If the scan passes, your plugin appears in My Plugins and is ready to sign. If it fails, you'll see specific errors — fix them and re-upload.

Signing Plugins

Signing is how you issue your plugin to a specific client. Every signed package is cryptographically locked to a single Panelr installation — it cannot be shared or reused on another installation.

Click Sign on any plugin to start the three-step signing flow:

1. 1Enter Installation ID — your client provides their Installation ID, found in their Panelr Cloud dashboard. Enter it and click Look Up Installation to verify it exists.
2. 2Confirm Installation — Panelr shows the installation details so you can verify you're signing for the right client. Confirm to proceed.
3. 3Sign & Download — Panelr generates a signed ZIP package locked to that installation. Download it and send it to your client.

Your client uploads the signed ZIP into their Panelr installation. Panelr verifies the cryptographic signature and file integrity automatically — if anything has been tampered with, the install is rejected. Once installed, they configure the plugin with their panel credentials from their admin dashboard.

Sign Plugin API

For developers distributing to many clients, Panelr provides a signing API that lets you automate the signing process programmatically. Instead of using the web interface for each client, you can sign and download packages via API calls from your own systems.