The XAPlayer secure player in Moodle
A tiny local plugin that shows XAPlayer’s protected videos only to students enrolled in a Moodle course. Works with Moodle 4.
All guides
Start
Quick start: your first protected course in 10 minutesVideo security: encryption, watermarks and what no player can doAdd to your site
Embed the secure player in WordPressSell video courses with WooCommerce and the secure playerThe XAPlayer secure player in MoodleThe XAPlayer secure player in LaravelThe XAPlayer secure player with Node.js and ExpressThe XAPlayer secure player in Next.jsThe XAPlayer secure player with Python: Django and FlaskHTML sites, site builders, or no serverFor sellers
Uploading videos and automatic protectionIssuing licenses, device limits and bulk issuingHow to stop IDM and downloaders from saving your course videosProtect course videos on WordPress and WooCommerceFor students
For students: watching a course with a license codePlatforms: Android, iPhone, Windows, Mac and LinuxWatching a course on AndroidWatching a course on iPhone and iPadWatching a course on Windows, Mac and LinuxFor developers
API reference: embed the secure player on any siteMoodle doesn’t let you run server code inside a page, so you’ll create a three-file local plugin. It checks the student is signed in and enrolled, then shows the player.
Before you start#
- In your XAPlayer panel, open Settings and create an API key. It is shown only once, so copy it right away.
- Under Websites allowed to show your player, add your site’s full address, such as https://academy.example.com. If your site also opens with www, add that too.
- Get the course ID: in Settings, pick the course in “Show the player on your website” and the ID is filled into the sample code. It is also the last part of the course page’s address in the panel.
- Have file access (FTP or SSH) to your Moodle server.
Put the key in Moodle’s config.php#
// config.php in your Moodle folder, before require_once(__DIR__ . '/lib/setup.php');
$CFG->xaplayer_api = 'https://en.xaplayer.ir/api/v1';
$CFG->xaplayer_api_key = 'xap_sk_...';
Create the plugin’s three files#
File: local/xaplayer/A new folder inside Moodle’s local folder
local/xaplayer/version.php
<?php
// local/xaplayer/version.php
defined('MOODLE_INTERNAL') || die();
$plugin->component = 'local_xaplayer';
$plugin->version = 2026111400;
$plugin->requires = 2022041900; // Moodle 4.0 or later
Install and use#
- Sign in to Moodle as an admin. The Notifications page lists the new plugin; choose Upgrade Moodle database now.
- In the Moodle course, add a URL resource with the address below. id is the Moodle course ID; course is the XAPlayer course ID.
- Open the link with a student account.
https://moodle.example.com/local/xaplayer/view.php?id=MOODLE_COURSE_ID&course=XAPLAYER_COURSE_IDIf it doesn’t work#
| What you see | Cause and fix |
|---|---|
| The player area is empty or the browser says it refused to connect | Your site isn’t in the allowed websites, or www differs. Add the page’s exact address. |
| 401 unauthorized | The API key is wrong, or you created a new key and the old one stopped working. Copy the key again. |
| 404 not_found | The course or video ID is wrong or belongs to another account. |
| 400 bad_request | The body is incomplete: send exactly one of courseId or videoId, and a non-empty viewer.id. |
| After a few hours the player says the page timed out | The token expired. Get a fresh token every time the page opens, and never cache the player address. |
Try XAPlayer free for 14 days, with 10 licenses on us.
Try it free with your own course