Official Documentation

Nova IPTV Player v1.0.0

Complete guide for buyers and developers · Current release: v1.0.0

Welcome to the official documentation for Nova IPTV Player v1.0.0. This guide is for buyers and developers who want to customize the app, change its identity (name, icon, package), and build a release-ready version.

What is this app?

Nova IPTV Player is built with Flutter from Google, so it runs on Android (phones and TV) and iOS from a single codebase. The app supports:

Requirements

Everything you need to run, edit, and build the project.

1. General

Install Flutter: Download from flutter.dev and add flutter/bin to PATH. Verify with:

flutter doctor -v

2. Android

The project supports Android TV (Leanback).

3. iOS

cd ios && pod install && cd ..
flutter run

4. Verify commands

flutter doctor -v
flutter pub get
flutter run
flutter run -d <device_id>

5. Project structure

Buyer First Run

This source package is delivered clean (without build/cache folders) to reduce file size.

On a new machine, run these commands once from project root:

flutter doctor
flutter pub get
flutter run

• flutter doctor: checks Flutter/SDK tools on the buyer machine.
• flutter pub get: downloads dependencies from pubspec.yaml.
• flutter run: recreates generated files and launches the app.

Excluded folders like build, .dart_tool, Pods, and .gradle do not contain app features. They are regenerated automatically.

Change Package Name

The package name identifies the app uniquely on the store and device. Change it in all of the following places.

Android

File: android/app/build.gradle.kts

android {
    namespace = "com.mybrand.iptv"   // was: nova.iptv.player

    defaultConfig {
        applicationId = "com.mybrand.iptv"   // was: nova.iptv.player
        // ...
    }
}

• Use lowercase letters, numbers, and dots only (no spaces).
• If you have MainActivity.kt under a path like nova/iptv/player/: create a new path like com/mybrand/iptv/, move the file, and update the first line to package com.mybrand.iptv.

iOS

From Xcode: Open ios/Runner.xcworkspace → Runner → Signing & Capabilities → change Bundle Identifier from nova.iptv.player to e.g. com.mybrand.iptv.

Or edit manually: In ios/Runner.xcodeproj/project.pbxproj search for PRODUCT_BUNDLE_IDENTIFIER = nova.iptv.player; and replace with the new identifier in all occurrences (Debug, Release, Profile).

Verify

flutter clean
flutter pub get
flutter run

Uninstall the old app from the device if it had the same Application ID / Bundle ID, then install again.

Change App Name & Icon

1. Display name

Android: File android/app/src/main/res/values/strings.xml — change <string name="app_name">Nova IPTV Player</string> to your branded name if needed. The default in the project is Nova IPTV Player.

iOS: File ios/Runner/Info.plist — find CFBundleDisplayName and change the value (e.g. to Nova IPTV Player).

Inside the app: In lib/helpers/constants.dart change const String kAppName = "Nova IPTV Player"; and in lib/helpers/app_translations.dart search for 'app_name': 'Nova IPTV Player' and update for the languages you use.

2. App icon

The app uses flutter_launcher_icons. Place your image in the project (e.g. assets/images/logo app.png) at 1024×1024 PNG.

In pubspec.yaml ensure:

flutter_launcher_icons:
  android: true
  ios: true
  image_path: "assets/images/logo app.png"
  remove_alpha_ios: true

Then run:

flutter pub get
dart run flutter_launcher_icons

Then flutter clean && flutter pub get && flutter run.

AdMob — change App ID & ad unit IDs (for buyers)

The app uses Google Mobile Ads (AdMob). Before publishing to Google Play or the App Store, the buyer must replace the seller’s AdMob identifiers with their own from AdMob. There are two kinds of values:

• App ID (format ca-app-pub-XXXXXXXXXXXXXXXX~YYYYYYYYYY) — one per platform (Android / iOS). Declared in native config so the SDK initializes correctly.
• Ad unit IDs (format ca-app-pub-XXXXXXXXXXXXXXXX/ZZZZZZZZZZ) — one per placement (e.g. banner, interstitial). Used when loading ads in the Flutter code (or overridden from your control panel response).

1. Android — App ID

File: android/app/src/main/AndroidManifest.xml

Inside <application>, find com.google.android.gms.ads.APPLICATION_ID and set android:value to your Android App ID from AdMob (starts with ca-app-pub- and contains ~).

<meta-data
    android:name="com.google.android.gms.ads.APPLICATION_ID"
    android:value="ca-app-pub-YOUR_PUBLISHER_ID~YOUR_ANDROID_APP_ID"/>

2. iOS — App ID

File: ios/Runner/Info.plist

Set GADApplicationIdentifier to your iOS App ID from AdMob (same ca-app-pub-...~... pattern).

<key>GADApplicationIdentifier</key>
<string>ca-app-pub-YOUR_PUBLISHER_ID~YOUR_IOS_APP_ID</string>

3. Banner & interstitial — default ad units (Flutter)

File: lib/repository/locale/admob.dart

This file defines the fallback ad unit IDs when the control panel does not send overrides. Replace the default strings with your AdMob Banner and Interstitial unit IDs for Android and iOS (each is a ca-app-pub-.../... string without ~).

The app may also read these keys from local storage when your panel returns them on activation (see Control panel requirements): banner_ad_unit_android, banner_ad_unit_ios, interstitial_ad_unit_android, interstitial_ad_unit_ios. If present, they override the defaults in code until cleared.

4. Checklist for the buyer

Do not ship with another seller’s ca-app-pub- IDs — use your own AdMob account so revenue and policy compliance are yours.

API keys — TMDB & OpenSubtitles (control panel)

The app uses two external APIs for movie/TV ratings (TMDB) and subtitle search inside the video player (OpenSubtitles). You manage both keys from the admin control panel — no app rebuild is required when you change them.

1. Where to set the keys in the panel

1. Log in to your admin panel (the PHP panel included in this package).
2. Open Settings from the sidebar.
3. Scroll to the section API keys (TMDB & OpenSubtitles) (between server settings and AdMob).
4. Paste your keys and click Save.

The panel stores credentials in the settings database table (tmdb_api_key, opensubtitles_api_key, opensubtitles_username, opensubtitles_password) and sends them to the app on every check-activation response.

2. How to get a TMDB API key

1. Create a free account at themoviedb.org.
2. Go to your profile → Settings → API.
3. Request an API key (Developer / personal use).
4. Copy the API Key (v3 auth) string.
5. Paste it into TMDB API key in the panel Settings page.

Used for: TMDB ratings on movie/series detail pages when the IPTV server has no rating, and resolving tmdb_id when searching subtitles.

3. How to get OpenSubtitles credentials

1. Create an account at opensubtitles.com.
2. Go to your profile → API consumers and create a consumer to get your API key (sent as Api-Key header).
3. Paste the API key into OpenSubtitles API key in panel Settings.
4. Also enter your OpenSubtitles username and password in the panel — required for subtitle downloads (JWT login).

Used for: the Search subtitles feature in the player (Movies & Series → Audio & Subtitles).

4. How the app receives the keys

On each activation check (POST /api/check-activation.php), the panel JSON includes:

{
  ...
  "tmdb_api_key": "your_tmdb_key",
  "opensubtitles_api_key": "your_opensubtitles_key",
  "opensubtitles_username": "your_username",
  "opensubtitles_password": "your_password"
}

The Flutter app saves them in local storage (GetStorage) and uses them at runtime. Keys are read from:

lib/repository/locale/panel_api_keys.dart

Fallback constants in lib/core/tmdb_config.dart and lib/core/opensubtitles_config.dart are empty by default — configure keys in the panel.

5. When changes take effect

• After saving in the panel, users get new keys on the next activation check (app launch, login screen refresh).
• No need to republish the app on Play Store / App Store.
• If a key is wrong or empty, ratings/subtitle search will fail silently or show an error message in the player.

Connecting the app to the control panel

Nova IPTV Player can work in two ways: with a control panel (activation, playlist from panel, optional ads/blocking) or standalone (user enters server URL + username + password manually). To use your own panel, you must point the app to your panel URL and ensure your panel implements the required API.

1. Set the panel base URL in the app

The app talks to a control panel over HTTPS. Configure your panel URL in one place. Open:

lib/core/config.dart

Change the following to your panel domain:

const String kActivationPanelBaseUrl = 'https://panel.yourdomain.com/';

Replace with your actual panel host (e.g. https://panel.yourdomain.com/). Use HTTPS and keep the trailing slash. The app will send requests to your panel API endpoints from this base URL (e.g. /api/check-activation.php).

2. How the app uses the panel

• On launch / login screen: The app sends the device ID to your panel (POST /api/check-activation.php). The panel responds with activation status and, if active, a domain (playlist URL or Xtream panel URL).
• Domain: If the panel returns a domain URL, the app can auto-fill the server URL. If the URL includes ?username=...&password=..., the app can auto-login with that user.
• Streaming: All live/VOD/series data is loaded from the user’s IPTV server (Xtream Codes player_api.php or M3U), not from your control panel. The panel only provides activation and the initial playlist/domain.

3. User flow summary

1. User opens the app → app calls your panel check-activation with device ID.
2. Panel returns status (e.g. active/inactive/expired) and optionally domain, username, password, app_name, ads settings, etc.
3. If active and domain is set, the app uses that URL (and credentials if present) to connect to the IPTV server (player_api.php or M3U).
4. If not active, user may need to “activate” (panel can provide an activate-device endpoint) or enter server URL + username + password manually.

For full request/response formats and all endpoints, see Control panel requirements below.

Control panel requirements

Your control panel must be hosted over HTTPS and expose the following API endpoints. All are POST (unless noted), with JSON body and JSON response.

1. Check activation

Endpoint: POST /api/check-activation.php

Request body:

{"device_id": "<device_id>"}

device_id is a unique device identifier (Android ID or iOS vendor ID).

Response (200 OK, JSON):

{
  "activated": true,
  "message": "",
  "expiry_date": "2026-12-31",
  "username": "optional_xtream_user",
  "domain": "https://iptv-server.com or https://iptv-server.com/playlist?username=u&password=p",
  "auto_activation_enabled": true,
  "ads_enabled": true,
  "banner_home_only": true,
  "banner_ad_unit_android": "ca-app-pub-xxx",
  "banner_ad_unit_ios": "ca-app-pub-xxx",
  "interstitial_ad_unit_android": "ca-app-pub-xxx",
  "interstitial_ad_unit_ios": "ca-app-pub-xxx",
  "app_name": "Nova IPTV Player",
  "block_vpn": false,
  "piracy_detection_enabled": false,
  "piracy_packages": ["com.screenrecorder.app", "com.videodownloader.app"],
  "piracy_message": "Please remove the app: {app_name}",
  "tmdb_api_key": "your_tmdb_api_key",
  "opensubtitles_api_key": "your_opensubtitles_api_key",
  "opensubtitles_username": "your_username",
  "opensubtitles_password": "your_password"
}

When activated is true, the app expects status in the format used in the app (e.g. “نشط” / “Active”); the app maps from activated: true to active status. domain is required for the app to load the playlist: either the Xtream panel base URL or a full M3U/playlist URL; optionally append ?username=...&password=... for auto-login. All other fields are optional.

2. Activate device

Endpoint: POST /api/activate-device.php

Request body: {"device_id": "<device_id>"}

Response: {"success": true, "already_active": false, "expiry_date": "...", "message": "..."}

Used when the user requests activation (e.g. after entering a code or from the panel).

3. Heartbeat

Endpoint: POST /api/heartbeat.php

Request body: {"device_id": "<device_id>"}

Called periodically when the user is active. Optional; used to track online devices.

4. Save playlist URL

Endpoint: POST /api/save-playlist.php

Request body: {"device_id": "<device_id>", "playlist_url": "<url>"}

Response: {"success": true}

Stores the user’s playlist/domain for that device so the panel can return it on next check-activation.

5. Delete playlist URL

Endpoint: POST /api/delete-playlist.php

Request body: {"device_id": "<device_id>"}

Response: {"success": true}

Clears the stored playlist for that device (e.g. on logout).

6. IPTV server (Xtream Codes / M3U)

The streaming data (live, VOD, series) is not served by your control panel. It is served by the user’s IPTV server. Your panel only returns the domain (and optionally credentials) that point to:

• An Xtream Codes API base URL (e.g. https://iptv.yourdomain.com), where the app will call GET {domain}/player_api.php?username=...&password=... and actions like get_live_categories, get_live_streams, get_vod_streams, get_series, get_vod_info, get_series_info, get_short_epg.
• Or a direct M3U playlist URL. In that case the app parses the M3U and does not use username/password for that playlist.

The Xtream server must respond to player_api.php with no action (or with user info) and return user_info (with username, password, status: "Active") and server_info (with server_url or equivalent). This is standard Xtream Codes API behavior.

Summary table

You can use the included admin panel in this source package or your own backend implementation, as long as the required endpoints are available over HTTPS.

Admin Panel Setup (Buyer)

Follow the steps below to install and configure the PHP Admin Panel on your hosting server. No advanced PHP knowledge is required.

Step 1 — Prepare Your Hosting

• Purchase a web hosting service that supports PHP 8.1+ and MySQL/MariaDB.
• Create or use an existing domain name.
• Enable HTTPS (SSL Certificate) on your domain.
• Open your hosting control panel (cPanel, Plesk or DirectAdmin).

Step 2 — Upload the Admin Panel Files

• Extract the downloaded CodeCanyon package.
• Open the admin panel folder.
• Upload all files to your hosting using File Manager or FTP.
• You can upload them inside public_html/ or inside a subfolder such as public_html/admin/.
• Wait until all files are uploaded successfully.

Step 3 — Create the Database

• Login to your hosting control panel.
• Open MySQL® Database Wizard.
• Create a new database.
• Create a database user.
• Assign the user to the database.
• Grant ALL PRIVILEGES to the database user.

Step 4 — Import the Database

• Open phpMyAdmin.
• Select the database you created.
• Click the Import tab.
• Select the SQL file included with this package.
• Click Import.
• Wait until the import process finishes successfully.

Step 5 — Configure Database Connection

• Open the following file:
admin panel/config/database.php
• Update the following values:
• Database Host
• Database Name
• Database Username
• Database Password
• Save the file.

Step 6 — Login to the Admin Panel

• Open your browser.
• Navigate to:
https://panel.yourdomain.com/admin/
• Default Demo Credentials (change them immediately after the first login for security purposes.):
• Username: admin
• Password: admin123456

Step 7 — Connect the Flutter Application

• Open:
lib/core/config.dart
• Locate:
kActivationPanelBaseUrl
• Replace the default URL with your own HTTPS domain (keep the trailing slash).
• Save the file.
• Run:
flutter clean flutter pub get
• Build the application again.

Step 8 — Verify Installation

• Open the Flutter application.
• Verify that the application can connect to the Admin Panel.
• Create a test playlist code.
• Activate the application.
• Confirm that the activation appears inside the Admin Panel.

Admin Panel Guide

After completing the Admin Panel Setup, use this guide to manage your IPTV platform from the included admin panel. Each page below is designed for day-to-day administration.

Dashboard

The Dashboard provides a complete overview of your IPTV platform at a glance. Monitor key metrics, recent activity, and system health from one central page.

• Total Users
• Active Devices
• Active Playlists
• Recent Activations
• System Statistics
• Quick Overview

Account Management

Administrators can create and manage administrator accounts, control access levels, and keep the panel secure.

• Create Administrator
• Edit Administrator
• Delete Administrator
• Manage Permissions
• Secure Login

Playlist Codes

Create and manage playlist activation codes for your customers. Assign M3U or Xtream playlists, set device limits, and configure expiration dates.

• Generate Random Codes
• Create Custom Codes
• Assign M3U Playlists
• Assign Xtream Playlists
• Configure Device Limits
• Configure Expiration Dates
• Edit Codes
• Delete Codes

Manage Activation

View and manage all activated devices. Search activations, monitor device status, and track expiration dates.

• View Activation History
• Search Activations
• Activate Devices
• Remove Devices
• Monitor Device Status
• Track Expiration

Settings

Configure application behavior, security options, API settings, and system preferences from a single settings page.

• General Settings
• Security Settings (VPN block, piracy detection)
• API Configuration
• System Preferences

Post-Install Checklist

Before delivering to clients or publishing, confirm all items below.

Piracy Detection & Package Blacklist

Nova IPTV Player includes a piracy detection feature that helps protect your streams from screen recording, video downloading, and link-leaking apps. It also works with the license activation server to validate the app package name and reduce unauthorized clones or modified APKs.

What does this feature do?

When enabled from the admin panel, the app scans the device for installed applications whose package names appear on your blacklist. If a blocked app is found, the user cannot pass the login screen and sees a clear message naming the app that must be removed.

This is useful for blocking tools that can record the screen, capture streams, or leak playlist links to other users.

How the package blacklist works

1. You enable Content piracy detection in the admin panel Settings page.
2. You add one Android package name per line (for example, com.screenrecorder.app).
3. When the app calls POST /api/check-activation.php, the panel returns piracy_detection_enabled, piracy_packages, and piracy_message in the JSON response.
4. On Android, the app compares installed apps against that list. If a match is found, login is blocked until the user uninstalls the flagged app.
5. The placeholder {app_name} in your custom message is replaced with the detected application name.

How administrators add package names

Open Admin Panel → Settings → Content piracy detection and follow these steps:

1. Turn on Enable piracy / link-leak apps detection.
2. In App package names — one per line, enter each package name on its own line. Example:

com.screenrecorder.app
com.videodownloader.app
com.linkleak.tool

To find a package name: on Android, open the app info page in system settings, or use adb shell pm list packages while testing on a device.

Optionally customize the user message, for example: Please remove the app: {app_name}

Click Save. The new list is sent to all devices on the next activation check.

How to remove package names

Edit the same textarea in Settings, delete the line you no longer want to block, and save. Removed package names stop blocking immediately on the next activation check.

To disable the feature entirely, turn off Enable piracy / link-leak apps detection and save.

Block cloned applications

Each buyer should publish the app under a unique package name (see Change Package Name). The Envato license check (see License) sends your app’s package_name to the activation server on launch.

The server registers the package name together with your purchase code and panel URL. If someone repackages the app under a different package name without a valid license, the app will not pass license verification.

Prevent unauthorized APK modifications

Release builds should always be signed with your own production keystore (see Build & Release). Combined with license verification and package-name registration, this reduces the risk of redistributed or tampered APKs being used with your panel.

Do not share your keystore file or key.properties credentials. Keep one official package name per published brand.

How the activation server validates package names

On every app launch, lib/services/seller_license_service.dart reads the installed app’s package name (for example, nova.iptv.player or your custom ID) and sends it to the license API together with:

• purchase_code — your CodeCanyon purchase code
• envato_username — your Envato username
• base_url — your activation panel host (from kActivationPanelBaseUrl)
• package_name — the app’s bundle / application ID

The server verifies the Envato license and associates the package name with your purchase. If verification fails, the app shows the license error screen and does not continue.

Your control panel separately returns the piracy blacklist through check-activation.php so you can manage blocked apps without rebuilding the Flutter project.

Best practices

• Block only apps you genuinely need to block — over-blocking may frustrate legitimate users.
• Use exact Android package names; typos will not match.
• Test on a real device after saving settings.
• Keep your custom message short and clear; use {app_name} so users know what to uninstall.
• Change the default admin password and use HTTPS on your panel before enabling security features.
• Update the blacklist when new screen-recording or downloader apps appear in your market.

Troubleshooting

Common issues and solutions when deploying the admin panel or building the Flutter application. Start with the Flutter SDK section if the project fails during flutter pub get or flutter build.

Common Flutter SDK Build Errors

Use this checklist when setup or build fails on a new machine. Always run commands from the project root (the folder that contains pubspec.yaml).

flutter doctor -v

flutter doctor --android-licenses

flutter --version
flutter channel stable
flutter upgrade
flutter clean
flutter pub get

flutter clean
flutter pub get
flutter run

cd android
./gradlew clean
cd ..
flutter clean
flutter pub get
flutter build apk

flutter clean
flutter pub get
flutter run

sudo gem install cocoapods
cd ios
pod repo update
pod install
cd ..
flutter clean
flutter pub get
flutter build ios

flutter channel stable
flutter upgrade
flutter doctor -v
flutter doctor --android-licenses
flutter clean
flutter pub get
flutter run

Common API Response Errors

HTTP status codes returned by the admin panel API or your hosting server. Each card below lists the problem, typical cause, and recommended fix.

Flutter Version Constraints — Extra Notes

For the full checklist (doctor, Gradle, JDK, licenses, CocoaPods, signing), see Common Flutter SDK Build Errors above. Typical version-constraint messages include:

• Because xxx depends on xxx which requires Flutter SDK version >= x.x.x, version solving failed.
• The current Flutter SDK version is x.x.x.
• Version solving failed. / pub get failed.
• Your current Flutter SDK version is not compatible with one or more packages.
• The current Dart SDK version is not supported.

Best practices: use the Stable channel, keep Flutter updated, avoid mixing dependency sets from different Flutter releases, and read package compatibility notes before flutter pub upgrade.

FAQ

Frequently asked questions about this package.

Application Screens

Preview of the main application screens included in this package.

Login

Secure login screen supporting Username/Password and Activation Code.

Home

Modern IPTV home screen with Live TV, Movies and Series.

Player

Professional video player with Better Player (ExoPlayer-based) & VLC Player support.

Settings

Application settings including language, theme, player selection and parental control.

Build & Release

How to create a release build for Android (APK / AAB) and iOS. Nova IPTV Player current release: v1.0.0 (version: 1.0.0+1 in pubspec.yaml).

1. Update version

In pubspec.yaml, set version: 1.0.0+1. The part before + is the user-facing version (1.0.0); the number after + is the build number (1). Increase both when you publish an update (for example, 1.0.1+2 for the next patch).

2. Android production signing

Google Play and production distribution require a signed release build. Debug signing is only for local testing. Follow every step below before uploading to a store.

2.1 What is a keystore?

A keystore is a secure file that stores your app’s signing key (certificate). Android uses it to prove that updates come from the same publisher. If you lose the keystore or its passwords, you cannot publish updates to the same Play Store listing — keep backups in a safe place.

2.2 Generate a keystore

Run this command from your project root (or any folder where you want to store the file). keytool ships with the JDK:

keytool -genkeypair -v \
-keystore upload-keystore.jks \
-keyalg RSA \
-keysize 2048 \
-validity 10000 \
-alias upload

You will be prompted for a keystore password, key password, and certificate details (name, organization, country). Remember these values — you need them in key.properties.

Move upload-keystore.jks into the android/ folder (same level as app/). Never commit this file to Git.

2.3 Create android/key.properties

Create a new file at android/key.properties (not inside app/). Add your credentials:

storePassword=YOUR_KEYSTORE_PASSWORD
keyPassword=YOUR_KEY_PASSWORD
keyAlias=upload
storeFile=upload-keystore.jks

storeFile is relative to the android/ folder. Add key.properties and *.jks to .gitignore so they are never uploaded to a repository.

2.4 Configure signingConfigs in android/app/build.gradle.kts

This project uses Kotlin DSL (build.gradle.kts). The file already loads key.properties when it exists. Confirm these sections are present:

val keystoreProperties = Properties()
val keystorePropertiesFile = rootProject.file("key.properties")
if (keystorePropertiesFile.exists()) {
    keystoreProperties.load(keystorePropertiesFile.inputStream())
}

android {
    signingConfigs {
        create("release") {
            if (keystoreProperties["storeFile"] != null) {
                storeFile = file(keystoreProperties["storeFile"] as String)
                storePassword = keystoreProperties["storePassword"] as String
                keyAlias = keystoreProperties["keyAlias"] as String
                keyPassword = keystoreProperties["keyPassword"] as String
            }
        }
    }
    buildTypes {
        release {
            signingConfig = if (keystorePropertiesFile.exists()) {
                signingConfigs.getByName("release")
            } else {
                signingConfigs.getByName("debug")  // local testing only
            }
        }
    }
}

If you use Groovy (build.gradle), the same logic applies: load properties before android { }, define signingConfigs.release, and set buildTypes.release.signingConfig signingConfigs.release.

2.5 Release signing explained

When key.properties exists, Flutter’s release build is signed with your production key. Without it, the project falls back to debug signing — acceptable for testing on your own device, but not accepted by Google Play for production uploads.

After configuring signing, always run flutter clean before the first signed release build.

2.6 Build a signed APK

An APK can be installed directly on devices (sideloading, testers, or stores that accept APK).

flutter clean
flutter pub get
flutter build apk --release

Output: build/app/outputs/flutter-apk/app-release.apk

Verify signing before distribution:

keytool -printcert -jarfile build/app/outputs/flutter-apk/app-release.apk

2.7 Build a signed AAB

An AAB (Android App Bundle) is the required format for Google Play. Google generates optimized APKs per device from your bundle.

flutter build appbundle --release

Output: build/app/outputs/bundle/release/app-release.aab — upload this file in Google Play Console.

2.8 When to upload APK vs AAB

For Play Store production, always prefer AAB. Keep your keystore backed up — you need the same key for all future updates.

3. iOS production signing & App Store

Requirements: a Mac, an active Apple Developer Account (paid membership), and Xcode. Follow these steps in order.

3.1 Apple Developer Account

Enroll at developer.apple.com/programs. You need this to create certificates, register an App ID, and submit to the App Store. Sign in with the same Apple ID in Xcode (Xcode → Settings → Accounts).

3.2 Certificates

A certificate proves you are an authorized Apple developer. For App Store distribution you need an Apple Distribution certificate. With automatic signing enabled, Xcode creates and manages certificates for you. You can also create them manually in the Apple Developer portal under Certificates, Identifiers & Profiles.

3.3 App ID

An App ID uniquely identifies your app on Apple’s systems. It must match your Bundle Identifier (for example, com.mybrand.iptv). Register it in the Developer portal or let Xcode create it when you enable automatic signing.

3.4 Bundle Identifier

In Xcode, select the Runner target → General → set Bundle Identifier to your unique ID. It must match the value you set in Change Package Name (default in source: nova.iptv.player). Each published app needs a globally unique bundle ID.

3.5 Provisioning Profiles

A provisioning profile links your App ID, distribution certificate, and (for development) allowed test devices. For App Store release you need an App Store distribution profile. Xcode downloads and installs the correct profile when automatic signing is on.

3.6 Automatic signing (recommended)

Open ios/Runner.xcworkspace → Runner target → Signing & Capabilities → enable Automatically manage signing → choose your Team. Xcode handles certificates and profiles. Confirm there are no red signing errors before archiving.

3.7 Manual signing (brief)

Disable automatic signing and select a specific Provisioning Profile and Signing Certificate manually. Use this only if your organization requires fixed profiles or CI/CD with exported certificates. Most buyers should use automatic signing.

3.8 Archive

Select a real device or Any iOS Device (arm64) as the build destination (not a simulator). Menu: Product → Archive. Wait until Xcode finishes — this creates a release build stored in the Organizer.

3.9 Validate Archive

In the Organizer window, select your archive → Validate App. Xcode checks signing, entitlements, and common App Store issues before upload. Fix any errors shown, then archive again if needed.

3.10 Upload to App Store Connect

Still in Organizer: Distribute App → App Store Connect → follow the wizard. After upload, open App Store Connect, select your app, attach the build, complete metadata (description, screenshots, privacy), and submit for review.

3.11 Common signing mistakes

• Bundle ID mismatch — Xcode bundle ID differs from Info.plist or Flutter iOS config. Keep them identical.
• Wrong team selected — Certificate belongs to another Apple Developer team.
• Expired certificate or profile — Renew in Developer portal or let Xcode refresh automatic signing.
• Building on simulator only — Archive requires a device / generic iOS destination, not a simulator.
• Opening .xcodeproj instead of .xcworkspace — Always open Runner.xcworkspace after pod install.
• Missing paid Developer membership — Free Apple IDs cannot distribute to the App Store.

Alternative (command line): After signing is configured, run flutter build ipa from the project root — output is in build/ios/ipa/.

4. Command reference

5. Optional

• Reduce APK size: minifyEnabled and shrinkResources are already enabled in android/app/build.gradle.kts for release builds.
• AdMob: Replace App IDs and ad unit IDs with your own AdMob account — see AdMob (change ad IDs).
• API keys: Set TMDB and OpenSubtitles keys in the admin panel — see API keys (TMDB & OpenSubtitles).