The XAPlayer secure player in Moodle

Add to your site3 min read

A tiny local plugin that shows XAPlayer’s protected videos only to students enrolled in a Moodle course. Works with Moodle 4.

All guides

Moodle doesn’t let you run server code inside a page, so you’ll create a three-file local plugin. It checks the student is signed in and enrolled, then shows the player.

Before you start#

  1. In your XAPlayer panel, open Settings and create an API key. It is shown only once, so copy it right away.
  2. Under Websites allowed to show your player, add your site’s full address, such as https://academy.example.com. If your site also opens with www, add that too.
  3. Get the course ID: in Settings, pick the course in “Show the player on your website” and the ID is filled into the sample code. It is also the last part of the course page’s address in the panel.
  4. Have file access (FTP or SSH) to your Moodle server.

Put the key in Moodle’s config.php#

config.php
// config.php in your Moodle folder, before require_once(__DIR__ . '/lib/setup.php');
$CFG->xaplayer_api     = 'https://en.xaplayer.ir/api/v1';
$CFG->xaplayer_api_key = 'xap_sk_...';

Create the plugin’s three files#

File: local/xaplayer/A new folder inside Moodle’s local folder

local/xaplayer/version.php
<?php
// local/xaplayer/version.php
defined('MOODLE_INTERNAL') || die();

$plugin->component = 'local_xaplayer';
$plugin->version   = 2026111400;
$plugin->requires  = 2022041900; // Moodle 4.0 or later

Install and use#

  1. Sign in to Moodle as an admin. The Notifications page lists the new plugin; choose Upgrade Moodle database now.
  2. In the Moodle course, add a URL resource with the address below. id is the Moodle course ID; course is the XAPlayer course ID.
  3. Open the link with a student account.
URL
https://moodle.example.com/local/xaplayer/view.php?id=MOODLE_COURSE_ID&course=XAPLAYER_COURSE_ID

If it doesn’t work#

What you seeCause and fix
The player area is empty or the browser says it refused to connectYour site isn’t in the allowed websites, or www differs. Add the page’s exact address.
401 unauthorizedThe API key is wrong, or you created a new key and the old one stopped working. Copy the key again.
404 not_foundThe course or video ID is wrong or belongs to another account.
400 bad_requestThe body is incomplete: send exactly one of courseId or videoId, and a non-empty viewer.id.
After a few hours the player says the page timed outThe token expired. Get a fresh token every time the page opens, and never cache the player address.

Try XAPlayer free for 14 days, with 10 licenses on us.

Try it free with your own course