Embed the secure player in WordPress

// wp-config.php: above the line "That's all, stop editing!"
define('XAPLAYER_API', 'https://en.xaplayer.ir/api/v1');
define('XAPLAYER_API_KEY', 'xap_sk_...'); // from Settings in your XAPlayer panel

<?php
// Shortcodes: [xaplayer course="COURSE_ID"]  or  [xaplayer video="VIDEO_ID"]
add_shortcode('xaplayer', function ($atts) {
    $atts = shortcode_atts(['course' => '', 'video' => ''], $atts, 'xaplayer');

    if (!is_user_logged_in()) {
        return '<p>Please sign in to watch this lesson.</p>';
    }

    $user = wp_get_current_user();
    $body = [
        'viewer'     => ['id' => (string) $user->ID, 'name' => $user->display_name],
        'ttlSeconds' => 4 * HOUR_IN_SECONDS,
    ];
    $phone = get_user_meta($user->ID, 'billing_phone', true);
    if ($phone) {
        $body['viewer']['phone'] = $phone; // shown on the video instead of the name
    }
    if ($atts['video'] !== '') {
        $body['videoId'] = $atts['video'];
    } else {
        $body['courseId'] = $atts['course'];
    }

    $res = wp_remote_post(XAPLAYER_API . '/embed-tokens', [
        'timeout' => 10,
        'headers' => [
            'Authorization' => 'Bearer ' . XAPLAYER_API_KEY,
            'Content-Type'  => 'application/json',
        ],
        'body' => wp_json_encode($body),
    ]);

    if (is_wp_error($res) || wp_remote_retrieve_response_code($res) !== 200) {
        return '<p>The player could not be loaded. Please refresh the page.</p>';
    }

    $url = json_decode(wp_remote_retrieve_body($res), true)['url'] ?? '';

    return sprintf(
        '<iframe src="%s" allow="fullscreen" style="width:100%%;aspect-ratio:16/9;border:0;border-radius:12px"></iframe>',
        esc_url($url)
    );
});