XUI One panel commands: the complete reference (2026)

If you run XUI One, sooner or later you will fix it from a shell, not from the browser. This reference collects the XUI One panel commands that matter: the service script, the tools helper, license and access-code repair, MySQL fixes for main servers and load balancers, and the Admin API. It replaces our 2023 “Mastering XUI panel commands” article. Commands are grouped by what you are trying to do, with a note on when to use each and what tends to go wrong.

Two things up front. XUI One is proprietary software; its binaries are closed, its internals are not publicly documented, and paths or options can differ between builds. Where we are not sure something applies to every release, we say “check your version”. Second, cracked XUI One builds circulate. We do not link or recommend them: a modified panel binary has full access to your customer database. Running XUI One at all is your own risk. For the installation side, see How to install XUI One; for how it compares with its predecessor, read XUI One vs Xtream UI.

Before you type anything

Every command below runs as root on the panel server unless we say it runs as the xui user. Database commands belong on the main server; load balancers have no database and only need their service restarted or re-authorised. Dump the xui database before any command that touches MySQL, and have the credentials from /home/xui/config/config.ini at hand.

Service control

The panel runs as one service that starts nginx, PHP-FPM and the stream workers together. The init script is xuione.

Command	What it does	When to use it
service xuione start	Starts nginx, PHP and the stream supervisors	After a reboot that did not bring the panel up, or after stop
service xuione stop	Stops everything, kills running stream processes	Before maintenance on disks, MySQL or the OS
service xuione restart	Full stop and start	After editing config.ini, after a license change, when streams are stuck
service xuione reload	Reloads nginx configuration without stopping streams	After creating access codes, changing ports or certificates
/etc/init.d/xuione stop then start	Same as above but shows the script’s own output	When you want to see why the service does not come up

The last row is the most useful one for troubleshooting. service hides output; the init script prints what fails: a MySQL connection refused, a license error, or a missing shared library after an OS upgrade. Read that output before you touch anything else.

What goes wrong: people run restart during peak hours to “fix” one stuck stream. A restart drops every active connection on that server. Stop the one stream via the API (stop_stream, below) and keep full restarts for maintenance windows. systemctl restart xuione works on some builds and not on others; check your version and stick to the script if in doubt.

The tools script

Current XUI One releases ship a repair helper at /home/xui/tools. It exists for the situation where the panel is installed but you cannot get into it. Run it as root on the main server:

/home/xui/tools [OPTION] [ARGUMENTS]

Option	What it does	When to use it
rescue	Creates a rescue access code for the admin interface	You lost or deleted the admin access code
user	Creates a rescue admin user	The only admin account is locked, deleted or has a forgotten password
mysql	Re-authorises the load balancers on MySQL	Load balancers show offline with “access denied” after a password change or a server move
database	Restores a blank XUI database	Fresh start on a broken install. Destroys your data. Dump first
migration [file.sql]	Clears the migration database, optionally imports an SQL file into xui_migrate	You are importing a Xtream UI database (see our Xtream UI uninstall guide for what to export first)
flush	Empties the blocked-IP table	A customer, your office or your own monitoring got blocked
ports	Regenerates nginx port configuration from the SQL table	Ports you changed in the panel are not actually listening
access	Regenerates access-code configuration from the SQL table	Access codes exist in the database but nginx returns 404 for them

What goes wrong: database sounds like a repair option and is not; it replaces your database with an empty one. If the tools script is missing on your build, the manual procedures below do the same job.

License commands

XUI One checks its license against the vendor. After installation you activate the panel by opening http://your-server:port/youraccesscode and following the access-code and license prompts. If the license later shows as invalid, the manual check works like this:

1. In the vendor’s billing panel, reissue the license. This applies to the main server only; load balancers inherit it.
2. Make sure the license key is in /home/xui/config/config.ini.
3. Remove the cached license file and run the license cron by hand, as the xui user:

rm /home/xui/config/license
sudo -u xui /home/xui/bin/php/bin/php /home/xui/crons/license.php

The script prints what it found: license key, status, and the reason if validation fails. Run it as xui, not as root, or the regenerated file ends up with the wrong owner and the panel cannot read it.

What goes wrong: a reissued license that still fails usually means the server cannot reach the vendor’s license endpoint. Check outbound DNS and HTTPS before you open a ticket. If your build did not come from the vendor, none of this applies.

Access codes and the admin login

XUI One has no /admin URL. Every interface, admin, reseller, API, sits behind an access code, a short random path that nginx knows about. Codes live in two places: the access_codes table in MySQL and one .conf file each in /home/xui/bin/nginx/conf/codes/. If the two disagree, you get a 404 or “You do not have access”.

Finding an existing code

ls /home/xui/bin/nginx/conf/codes/

Each .conf file is an access code; try its name without the extension as the path. “You do not have access” at login means the code belongs to a reseller or API group, not that your password is wrong.

Creating an admin code by hand

If /home/xui/tools rescue is not available on your build, create a code manually. In the codes/ directory, copy the template file to admin.conf and edit it:

• replace #CODE# with admin
• replace #TYPE# with admin
• delete the #WHITELIST# placeholder

Then register the same code in the database and reload nginx:

USE `xui`;
INSERT INTO `access_codes` (`code`, `type`, `enabled`, `groups`) VALUES ('admin', 0, 1, '[1]');

service xuione reload

The admin interface is now at http://your-server:8080/admin (8080 is the default admin port in the builds we have seen; check your version). Delete this code once you have created a random one; a predictable admin path invites scanners.

Resetting the admin user

To reset user ID 1 to admin / admin, run this on the main server’s MySQL:

USE `xui`;
REPLACE INTO `users` (`id`, `username`, `password`, `member_group_id`, `status`, `owner_id`, `date_registered`)
VALUES (1, 'admin', '$6$rounds=20000$xui$eQfRsD2gsIUhoY5RnnYN82qiB5VeZTcHICQrFxXpa98J2R1454b6lzVHVjiJ.NP0gi0X3K7NXVgxeR1VhVhg61', 1, 1, 0, UNIX_TIMESTAMP());

The hash corresponds to the password admin and has shipped with XUI One since the first releases; check your version if the login still fails. Change the password immediately. REPLACE overwrites the whole row, so use it only on the original admin account.

MySQL access denied

“Access denied” from the panel means the credentials in config.ini no longer match the MySQL user. On the main server, edit /home/xui/config/config.ini and set the [Encrypted] section to the credentials you were given at install time:

[Encrypted]
username = "your_user"
password = "your_password"

Save and service xuione restart.

On a load balancer, re-authorise instead of editing: run /home/xui/tools mysql on the main server, or use Management → Tools → Quick Tools → General in the panel. Both regenerate the MySQL grants for the load balancer IPs. If it still cannot connect, check in this order:

1. Does the load balancer’s current IP match the one stored in the panel? Servers that changed IP after a reinstall are the most common cause.
2. Can it reach the main server’s MySQL port? Firewalls often allow only the old IP.
3. Does the panel’s MySQL user have the GRANT privilege? Without it you must add the grants as root in MySQL yourself.

Load balancer offline

When a load balancer shows offline in the panel, SSH into the load balancer and run the init script directly:

/etc/init.d/xuione stop
/etc/init.d/xuione start

The output names one of three usual causes: MySQL (see above), license (the main server’s license is invalid, so the load balancer refuses to start), or missing libraries after an OS package upgrade. Fix the cause on the server the message points at; restarting again changes nothing.

The Admin API

XUI One has an HTTP API that covers almost everything the admin interface does. Use it to create lines from a billing system, pull stats into monitoring, or stop a single stream without touching the shell.

Enabling it

1. In the panel open Management → Access Control → Access Codes.
2. Add a code with the access type Admin API and the group Administrators.
3. Restrict it to the IP of the calling server; an unrestricted API code is a full admin login.
4. The API key is on the admin user’s profile page.

Calls look like this:

https://your-domain:port/your-api-access-code/?api_key=YOURKEY&action=get_packages

Each call sets action to one command and passes parameters as POST fields or query parameters. The parameters are not publicly documented. To discover them, enable Developer Tools in the admin interface, perform the action in the browser, and log what the UI sends to post.php; the same field names work with the matching API action. To edit an object, pass its id with the fields you change.

Command groups

Most object types follow one pattern: get_<plural> lists, get_<type> fetches one by id, and create_, edit_, delete_ change it. The table names the object types and the commands that break the pattern.

Group	Object types (standard pattern)	Extra commands	Notes
Information	user_info, get_users, get_lines, get_mags, get_enigmas, get_streams, get_channels, get_stations, get_movies, get_series_list, get_episodes	mysql_query	mysql_query runs raw SQL as the panel’s database user. Treat it as root
Logs and events	activity_logs, live_connections, credit_logs, client_logs, user_logs, stream_errors, watch_output, system_logs, login_logs, restream_logs, mag_events		Poll live_connections for dashboards, at a sane interval
Lines	line	enable_line, disable_line, ban_line, unban_line	What a billing integration mostly needs
Users	user	enable_user, disable_user	A “user” is a panel login, not a subscriber
MAG and Enigma devices	mag, enigma	enable_, disable_, ban_, unban_, convert_ for each	convert_* turns a device into a normal line
Catalogue	bouquet, category, package, group, subreseller		Plural get_bouquets, get_packages etc. list; singular forms take id
Access codes, HMAC	access_code, hmac		delete_access_code can lock you out. Keep one code outside automation
EPG	epg	reload_epg	Call reload_epg after changing a source URL
Streams, channels, stations	stream, channel, station	start_, stop_ for each	stop_stream with an id is the surgical alternative to a restart
VOD	movie, series, episode	start_, stop_ for movies and episodes	Bulk imports loop over create_movie; watch the rate
Infrastructure	transcode_profile, rtmp_ip, watch_folder	reload_watch_folder	Useful for provisioning a new server from a template
Blocking	get_blocked_ips, add_blocked_ip, delete_blocked_ip; same with _isp and _ua	flush_blocked_ips	The API twin of tools flush
Servers	server	install_server, install_proxy, edit_proxy	install_server runs the remote load balancer install over SSH
Settings and server operations	get_settings, edit_settings	get_server_stats, get_fpm_status, get_rtmp_stats, get_free_space, get_pids, get_certificate_info, reload_nginx, clear_temp, clear_streams, update_blacklist, get_directory, kill_pid, kill_connection, reload_cache	Server operations need server_id

The server-specific actions in the last row all require server_id. Without it the panel either answers for the main server or returns an error, depending on the build.

What goes wrong with the API: three things, repeatedly. The key in the URL ends up in web server and proxy logs, so use TLS and rotate keys. mysql_query gets used from a script that someone later edits, and a typo becomes a DELETE without a WHERE. And a monitoring script polls live_connections every second on a panel with thousands of lines, which is enough to slow the admin interface for everyone.

Closing note

Everything above assumes a panel installed from a release you trust and can update. If maintaining a closed-source panel by hand is more work than you want, our guides index covers alternatives, including a hosted panel we review in detail. Whatever you run, keep the database dumps coming: none of these commands help when the data is gone.