Embedding the secure player on your site, WordPress or LMS

Put the XAPlayer secure player on your own lesson pages with a short-lived token: works with any site, WordPress or LMS, with Node.js and PHP examples.

If you sell on your own site, students don’t need a license code. Your server asks for a short-lived token for the signed-in student and the player appears on the lesson page.

Set up

1. In Settings, create an API key and keep it on your server only.
2. Add your site’s domain to Allowed domains. The player will not show on any other domain.
3. Copy the course or video ID from its page in the panel.

Get a token on your server (Node.js)

// On your server, for the signed-in student
const res = await fetch('https://en.xaplayer.ir/api/v1/embed-tokens', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer ' + process.env.XAPLAYER_API_KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    courseId: 'COURSE_ID',          // or videoId: 'VIDEO_ID'
    viewer: { id: user.id, name: user.name, phone: user.phone },
    ttlSeconds: 14400,
  }),
});
const { url } = await res.json();

Show the player

<iframe src="{url}" allow="fullscreen"
        style="width:100%;aspect-ratio:16/9;border:0"></iframe>

WordPress (PHP)

<?php
// WordPress: inside your lesson template, for the logged-in student
$user = wp_get_current_user();
$res = wp_remote_post('https://en.xaplayer.ir/api/v1/embed-tokens', [
  'headers' => [
    'Authorization' => 'Bearer ' . XAPLAYER_API_KEY,
    'Content-Type'  => 'application/json',
  ],
  'body' => wp_json_encode([
    'courseId' => 'COURSE_ID',
    'viewer'   => ['id' => (string) $user->ID, 'name' => $user->display_name],
  ]),
]);
$url = json_decode(wp_remote_retrieve_body($res), true)['url'];
?>
<iframe src="<?= esc_url($url) ?>" allow="fullscreen" style="width:100%;aspect-ratio:16/9;border:0"></iframe>

Two display modes

• With courseId: the whole course with its lesson list.
• With videoId: a single video, no list.

Never put the API key in browser code or a public theme. If it leaks, create a new key in Settings; the old one stops working at once.