From clean server to
ready to stream.

1. Upload and expose only public/

   Deploy the backend files. Configure the domain document root as /path/to/LaravelEasyplex/public. If your host cannot change it, move only the contents of public/ to the web root and carefully update paths in index.php.

2. Create the environment file

   Copy .env.example to .env. Set APP_ENV=production, APP_DEBUG=false, the HTTPS APP_URL, and database credentials. Keep .env outside public access.

   .env — essential valuesCopy

   APP_NAME=EasyPlex
   APP_ENV=production
   APP_KEY=
   APP_DEBUG=false
   APP_URL=https://stream.example.com
   
   DB_CONNECTION=mysql
   DB_HOST=127.0.0.1
   DB_PORT=3306
   DB_DATABASE=easyplex
   DB_USERNAME=easyplex_user
   DB_PASSWORD=use-a-strong-password
   
   CACHE_DRIVER=file
   SESSION_DRIVER=file
   QUEUE_CONNECTION=database

3. Install and initialize

   The release intentionally does not bundle Composer’s vendor/ directory. Install the locked production dependencies on the server after upload:

   TerminalCopy

   composer install --no-dev --optimize-autoloader
   php artisan key:generate
   php artisan migrate --force
   php artisan db:seed --force
   php artisan passport:keys
   php artisan storage:link
   php artisan optimize:clear

   The bundled seed creates temporary administrator and user accounts. Their first-login credentials and mandatory security steps are shown in the clearly labeled Default credentials after seeding section immediately below.

4. Set permissions

   The web-server user must be able to write to storage/ and bootstrap/cache/. Uploaded artwork and generated files also depend on the configured public storage disk.

5. Configure background work

   Cron (every minute)Copy

   * * * * * cd /path/to/LaravelEasyplex && php artisan schedule:run >> /dev/null 2>&1

   Also keep a supervised php artisan queue:work --tries=3 process running when using database/Redis queues. Copy the complete production configuration from the dedicated Supervisor and systemd queue-worker guide.

6. Activate EasyPlex

   Open your domain. On the Activate Easyplex screen, confirm that the detected domain is correct, enter your own purchase code, and select Activate License. The red “Activation not found” notice is expected before a new domain has been activated.

   

8. Synchronize the verified panel files

   After activation, EasyPlex may show the Pre-Installation Update page. When the status says an update is available and the download is authorized, select Sync panel files. Keep the page open until synchronization finishes; do not refresh the browser or interrupt PHP during this operation.

   

9. Secure the administrator and configure the panel

   When the dashboard opens, sign in to the administrator account, immediately replace the seeded password, and then work through the settings checklist below.

1. Visit /login and sign in with the administrator row above.
2. Open the administrator profile/account controls and replace the email and password.
3. Open Users, then delete the sample user or assign it unique credentials.
4. Sign out, verify the old administrator password no longer works, then sign in with the new credentials.
5. Store the new administrator password in a password manager and enable the server protections described in this guide.

1. Back up the 2.3 installation

   In phpMyAdmin, select the current EasyPlex database, open Export, choose the SQL format, and download a complete backup. Also copy .env, storage/app/public/, uploaded media, OAuth keys, and any customized files. Do not continue until the backup has finished downloading.

2. Deploy the 2.4 panel files

   Put the website in maintenance mode if available, then upload the 2.4 web-panel files. Preserve the production .env file and uploaded storage—do not replace them with package defaults.

3. Open the correct database in phpMyAdmin

   Sign in to phpMyAdmin and select the database used by the existing EasyPlex 2.3 installation from the left sidebar. If you are unsure which one to select, open the panel’s .env file and use the value of DB_DATABASE.

4. Choose the included upgrade file

   With the correct database selected, open the Import tab, select Choose file, and browse to this file in the EasyPlex 2.4 package:

   Upgrade_from_2.3_to_2.4easyplex_2_3_to_2_4.sqlSQL database upgrade file

   Keep the format set to SQL. Leave the character set as UTF-8 unless your existing database uses a different known encoding.

5. Import the SQL file

   Scroll to the bottom of the Import page and select Import or Go. Wait for phpMyAdmin to display a successful import message. Do not close the tab, refresh the page, or import the file a second time while the first request is running.

6. Clear caches and verify 2.4

   After a successful SQL import, clear the Laravel cache from the hosting terminal or the panel’s Laravel maintenance tools. If terminal access is available, run:

   TerminalCopy

   php artisan runtime:refresh-state
   php artisan optimize:clear
   php artisan queue:restart

   Open the dashboard and verify that settings save correctly. Test authentication, home content, playback, uploads, subscriptions, credits, and scheduled tasks before reopening the application to users.

1. Create the R2 bucket

   In Cloudflare Dashboard, open R2 object storage, create a bucket, and choose a permanent name such as easyplex-media. Copy the name exactly; it becomes the panel's R2 bucket value.

2. Create scoped S3 credentials

   Open Manage R2 API Tokens and create credentials with Object Read & Write access restricted to this bucket. Save the generated Access Key ID and Secret Access Key immediately. Do not use a global Cloudflare API key or place these credentials in Android, JavaScript, source control, or documentation.

3. Copy the account endpoint

   Copy the S3 API endpoint shown by Cloudflare. EasyPlex expects this format:

   R2 S3 endpointCopy

   https://<ACCOUNT_ID>.r2.cloudflarestorage.com

   Do not use the public custom domain here and do not append the bucket name.

4. Configure public delivery

   Open the bucket's Settings page and connect a custom domain such as media.example.com. Use https://media.example.com as the panel's R2 public URL. Cloudflare's r2.dev public development URL can be used for testing, but it is rate-limited and is not recommended for production delivery.

5. Enter the values in EasyPlex

   Open Admin → Settings → Storage, enable Cloudflare R2 Storage, and complete every R2 field. Selecting R2 disables AWS S3 and Wasabi because only one primary cloud provider can be active.

   EasyPlex field	Cloudflare value	Example
   R2 access key ID	Access Key ID from the scoped R2 API token	your-access-key-id
   R2 secret access key	Secret Access Key shown once when the token is created	keep-this-private
   R2 bucket	Exact bucket name	easyplex-media
   R2 S3 endpoint	Account-level S3 API endpoint	https://ACCOUNT_ID.r2.cloudflarestorage.com
   R2 public URL	Public custom domain or development r2.dev URL	https://media.example.com

6. Save, clear caches, and restart workers

   Select Save Settings, then run:

   Laravel maintenanceCopy

   php artisan optimize:clear
   php artisan queue:restart

   Queue workers must have outbound HTTPS access to the R2 endpoint. Enhanced video conversion also requires the normal EasyPlex FFmpeg worker configuration.

7. Verify every upload path

   Upload one artwork image, one normal video file, and one enhanced video. Confirm the saved URLs begin with the configured R2 public URL, play over HTTPS, and appear under EasyPlex-managed prefixes such as images/, movies/, series/, or animes/. Delete a test managed video link and confirm its object is removed. Buyer-supplied external URLs are intentionally never deleted.

Cloudflare R2 S3 setup guide · R2 API token guide · Public bucket and custom-domain guide · R2 CORS guide

1. Open the project root

   In Android Studio choose Open and select the folder containing settings.gradle—not the nested app/ folder. Let Gradle sync finish before changing identifiers.

2. Set the application ID

   Change namespace and applicationId in app/build.gradle, then refactor the Java package currently under com.easyplexdemoapp. Update the package in Firebase, OAuth, Facebook, deep-link and store configurations at the same time.

3. Set version and name

   Update versionCode for every store release and set the public versionName. Change the app label in app/src/main/res/values/strings.xml, then replace launcher icons through Android Studio’s Image Asset tool.

4. Use the correct JDK and SDK

   Set the Gradle runtime to JDK 17, install Android SDK Platform 36 and current Build Tools, then sync. The source compiles with Java 11 compatibility, and the app supports Android 7.0 (API 24) and newer.

gradlew.bat clean test
gradlew.bat lintRelease
gradlew.bat bundleRelease
# Or create an APK:
gradlew.bat assembleRelease

• Use a private release keystore and keep encrypted backups of it and its credentials.
• Set a unique applicationId, increment versionCode, and align the panel’s Updates version with the APK/AAB.
• Verify HTTPS, app links, login, playback, downloads, casting, notifications, payments, profiles and the in-app update flow on a release build.
• Release builds disable cleartext HTTP and enable code/resource shrinking.
• If required for a target device/store workflow, set ENABLE_16KB_APK_WORKAROUND=true; the build contains an opt-in 16 KB APK alignment verification flow.

1. Open the movie, series episode, or anime episode in the admin panel and choose Add New Video Link.
2. Paste the complete HTTPS provider URL, select its language and quality, and enable Supported Hosts.
3. Leave HLS off unless the input itself is a direct .m3u8 playlist. Leave Embed off when the AAR resolver should handle the URL.
4. Save the link, test it on a physical Android device, then test seeking, subtitles, next-episode playback, downloads (when allowed), and casting separately.

php artisan runtime:refresh-state
php artisan optimize:clear

php artisan schedule:list
php artisan schedule:run

php artisan video:cleanup-jobs --dry-run
php artisan video:cleanup-jobs

php artisan subscriptions:sync-status

php artisan content:sync-new-episodes

php artisan subtitles:setup

Monitor storage/logs/laravel.log, queue failures, disk space, database growth, payment reconciliation, FFmpeg jobs and certificate expiry. Take automatic database and media backups and test restoration regularly.

Keep queue workers running

Set QUEUE_CONNECTION=database (or a configured Redis connection) and use one process manager, not both. Replace the example paths, PHP binary, and Linux user with values from your server. The worker user must be able to write to storage/ and bootstrap/cache/. Reload the manager after every deployment and run php artisan queue:restart so workers pick up new code safely.

cd /var/www/easyplex
php artisan migrate --force
php artisan optimize:clear
php artisan queue:work --once --tries=3 --timeout=300
php artisan queue:failed

[program:easyplex-worker]
process_name=%(program_name)s_%(process_num)02d
command=/usr/bin/php /var/www/easyplex/artisan queue:work --sleep=3 --tries=3 --timeout=300 --memory=256
directory=/var/www/easyplex
autostart=true
autorestart=true
stopasgroup=true
killasgroup=true
user=www-data
numprocs=1
redirect_stderr=true
stdout_logfile=/var/www/easyplex/storage/logs/worker.log
stdout_logfile_maxbytes=20MB
stdout_logfile_backups=5
stopwaitsecs=360

sudo supervisorctl reread
sudo supervisorctl update
sudo supervisorctl start easyplex-worker:*
sudo supervisorctl status easyplex-worker:*
sudo tail -f /var/www/easyplex/storage/logs/worker.log

[Unit]
Description=EasyPlex Laravel queue worker
After=network.target mysql.service

[Service]
Type=simple
User=www-data
Group=www-data
WorkingDirectory=/var/www/easyplex
ExecStart=/usr/bin/php artisan queue:work --sleep=3 --tries=3 --timeout=300 --memory=256
Restart=always
RestartSec=5
TimeoutStopSec=360
KillSignal=SIGTERM

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now easyplex-worker
 sudo systemctl status easyplex-worker
 sudo journalctl -u easyplex-worker -f

* * * * * cd /var/www/easyplex && /usr/bin/php artisan schedule:run >> /dev/null 2>&1

Complete request and response examples

JSON requests use Content-Type: application/json. When mobile request signing is enabled, calculate X-Signature over the exact method, path, timestamp, nonce, and raw JSON body as described in the Security section. Values below are examples only.

POST /api/tokens/mobile/generate HTTP/1.1
Host: stream.example.com
Content-Type: application/json
Accept: application/json
X-App-Id: easyplex-mobile
X-Timestamp: 1760000000
X-Nonce: 4f3f2448-57a1-4c07-9948-4ef8af6d63c2
X-Signature: sha256=CALCULATED_HEX_HMAC
X-Device-Id: 8fe21e37-8a1c-45f0-9085-b992892f8d07

{
  "app_id": "easyplex-mobile",
  "device_id": "8fe21e37-8a1c-45f0-9085-b992892f8d07",
  "package_name": "com.example.easyplex",
  "platform": "android",
  "timestamp": 1760000000,
  "nonce": "4f3f2448-57a1-4c07-9948-4ef8af6d63c2",
  "signature": "9A63192D838D0A4F4F6E4178419293736D574721E1550D4A25F9945D65C73D8A"
}

{
  "success": true,
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOi...",
  "refresh_token": "ROTATING_REFRESH_TOKEN",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_expires_in": 2592000,
  "session_id": "b65892dc-474f-45e7-9bec-3280d91ce01f"
}

POST /api/watch-history/progress HTTP/1.1
Authorization: Bearer ACCESS_TOKEN
Content-Type: application/json
Accept: application/json
X-App-Id: easyplex-mobile
X-Device-Id: 8fe21e37-8a1c-45f0-9085-b992892f8d07
X-Session-Id: b65892dc-474f-45e7-9bec-3280d91ce01f
X-Timestamp: 1760000030
X-Nonce: 15d99c27-0609-42d1-b4ef-9639be41bd84
X-Signature: sha256=CALCULATED_HEX_HMAC

{
  "watchable_type": "App\\Movie",
  "watchable_id": 42,
  "episode_id": null,
  "current_position": 754,
  "duration": 6420,
  "device_id": "8fe21e37-8a1c-45f0-9085-b992892f8d07",
  "profile_id": 3
}

{
  "success": true,
  "message": "Watch progress saved successfully",
  "data": {
    "id": 91,
    "profile_id": 3,
    "progress_percentage": 11.74,
    "current_position": 754,
    "duration": 6420,
    "last_watched_at": "2026-07-29T12:30:30.000000Z"
  }
}

{
  "success": false,
  "message": "Validation failed",
  "errors": {
    "device_id": [
      "The device id field is required."
    ]
  }
}

{
  "success": false,
  "message": "Authentication failed. Invalid APK signature or request parameters.",
  "error_code": "INVALID_SIGNATURE",
  "hint": "Check Laravel logs (storage/logs/laravel.log) for detailed error."
}

{
  "success": false,
  "error": {
    "code": "SIGNED_REQUEST_REJECTED",
    "message": "Unauthorized request."
  }
}