The Cue console, page by page for engineers moving their streams from another media server

01 What Cue changes, and what it doesn't

Cue Media Server is the streaming engine we write ourselves. It runs as a service on your dedicated server, in place of the streaming server you ran before, and it is built to answer the outside world the way that server did. Nothing that talks to your server should need reconfiguring.

Kept as it is

• Applications and stream names. Each application or stream on your previous server becomes a Cue application with the same name. Encoders publish to the same application and stream names they use today.
• Publishing credentials. The importer reads the publishing passwords from your previous server's configuration, so encoders sign in with the passwords they already hold. Where a password genuinely cannot be read, a new one is made and shown once, and the import result says so.
• Publishing addresses. RTMP on port 1935 with the usual user-and-password sign-in exchange, the _definst_ and app/stream spellings, and rtmp://your-server/static with <name>?password= as the key where your channels were published that way.
• Player addresses. /<app>/<stream>/playlist.m3u8 (with or without _definst_, and ?DVR for rewinding), smil: and ngrp: adaptive addresses, and manifest.mpd; and /<name>/index.m3u8, video.m3u8, mono.m3u8, embed.html, preview.jpg and the archive and timeshift addresses.
• The tools around the engine. Cue also answers the management APIs your existing tools and control panels (MediaCP included) may already use, with the same credentials, along with the on_play/on_publish authorization backends and event_sink webhooks they call. Signed playback links your website already makes keep validating when you give Cue the same shared secret.

New with Cue

• One web console on port 8443 in place of your previous server's manager, covering applications, encoders, players, security, recordings, restreaming, imports, graphs, logs, users and updates.
• Every ingest on every application: RTMP, RTMPS, SRT with encryption, WebRTC (WHIP), RTSP publishing, and pulls from RTSP cameras, SRT, HLS, MPEG-TS over UDP or HTTP and other RTMP servers, with up to four backup sources that take over automatically.
• Every output from every application: HLS (MPEG-TS, fMP4/CMAF or Low-Latency), MPEG-DASH, WebRTC (WHEP), RTMP and RTMPS, SRT, RTSP and MPEG-TS over HTTP, plus a hosted player page and embed code.
• ABR ladders on the processor, on an NVIDIA card (NVENC) or on Intel Quick Sync on Linux, with logo, deinterlacing, aspect and audio controls.
• SCTE-35 handling end to end: cues from SRT, MPEG-TS and RTMP become HLS ad markers on segments cut at the splice point, and you can insert a break yourself through the API.
• Signed, verified updates you schedule from the console, a free Let's Encrypt certificate for your server's name, two-factor sign-in and scoped API tokens.

What does not carry over today, and the importer tells you per application: video-on-demand applications (the VOD library comes later), edge/repeater applications (import the origin instead), first-generation secure tokens, more than five stream targets per application, and stream targets that are not RTMP. Transcoder templates are not read: an application that had the transcoder on gets Cue's HD ladder instead, which you can change.

02 Switch day

We do the move. Before your switch time, Cue is installed next to your current engine and your applications are imported. In that state the old engine still owns ports 1935, 80 and 443 and serves every viewer, while Cue answers on port 1936 for publishing and playback tests and on 8443 for its console. That window is the best time to learn the console: sign in, look at your imported applications, and if you like, point a spare encoder at port 1936 and watch it on the application's preview.

At the agreed time we press Switch to Cue on the console's Server page. The console warns that your old engine "is stopped and disabled, and Cue takes port 1935 (and 80/443 if nothing else uses them)". Encoders reconnect by themselves and players retry; the interruption we plan for is one to five minutes. If Cue does not come up, the old engine is started again automatically.

Your old engine stays installed, stopped and disabled. The Server page then offers a button to switch back to it, which takes about a minute. Tell us before you use it, so we can look at whatever made you want to.

03 Signing in to the console

1. Open https://your-server:8443/classic/ in a browser. Use the server's IP address or a DNS name that points at it.
2. The first time, the browser warns that the certificate is not trusted. That is expected: until your server has a name with a Let's Encrypt certificate (see Settings), Cue protects the console with a certificate it made itself. The connection is still encrypted. Accept the warning for this address and go on.
3. At Sign in to manage this server. enter the user name and password. The administrator account is admin unless we agreed another name with you.
4. If two-factor sign-in is on for your account, a third field appears: Code from your authenticator app (or a recovery code).

Your password

We never send passwords by email. Before the switch we send you a secure link through which you set the administrator password yourself. After that you can change it at any time under Settings › Your password; a new password needs 10 characters or more.

Lost it? Ask us and we will reset it. If you are an administrator on the server itself, you can also print a new one there (see On the server).

Two-factor sign-in

1. Go to Settings, find Two-factor sign-in and press Turn on.
2. Add the key it shows to an authenticator app (Google Authenticator, 1Password, Authy and the like), or use Copy otpauth link with an app that takes such links.
3. Enter the code the app shows and press Turn on. The console then shows your recovery codes once. Each signs you in once if you lose the phone; keep them somewhere safe.

More people, and programs

Under Settings, Users lists who can sign in. Add user makes an Administrator (changes everything) or a Read-only user (sees everything, secrets stay hidden, changes nothing); the new password is shown once for you to pass on. API tokens are for scripts, panels and WebRTC encoders and players: see APIs.

If your licence also includes the Cue Reseller Panel, https://your-server:8443/ (without /classic/) opens the panel instead. See chapter 15.

04 A tour of the console

The header carries five pages: Applications, IPTV, Server, Logs and Settings. IPTV shows only while the IPTV service is part of your server. Pages refresh themselves every few seconds, so you can leave one open on a wall screen.

• ApplicationsYour channels, live state, viewers, and Import.
• An applicationEncoder details, player addresses, security, recording, restream.
• IPTVSubscriber lines, bouquets, guide, resellers.
• ServerHealth, transcoding, the switch, graphs, updates.
• LogsServer log, and every sign-in and change.
• SettingsLicence, name, certificate, password, users, tokens.

Applications

The list shows each application with a thumbnail while it is live, how long it has been live (or whether publishing is password-protected or open), its viewers, and a status: Live, Waiting for encoder or Stopped. New application asks for a name (letters, digits, dots, - and _), whether to Require a password to publish, and Maximum viewers; the publishing password is then shown once. Import reads your previous server's configuration (see what an import carries). When an update is available, a notice here links to the Server page.

An application's page

Click an application to open it. From top to bottom:

• The header: the status, Stop/Start (stopping disconnects the encoder and ends the stream for viewers) and Delete, which removes the application, its address, its password and its recordings for good.
• Four figures: viewers now, most at once, sent since start and live for.
• Viewers and traffic: two graphs, over 6 hours, 24 hours, 7 days or 30 days.
• Connect your encoder: the RTMP server, RTMPS when the server has HTTPS playback, the stream name, the user name, and SRT, WebRTC (WHIP) and RTSP addresses. See chapter 5. For an application that pulls its stream, this card is Source instead.
• Watch: a live preview, the renditions line, any SCTE-35 cues, every playback address and the embed code. See chapter 6.
• Who may watch and Authorization backend: see chapter 11.
• Streams from elsewhere: cameras and other servers read under their own stream names (stream files or inputs on your previous server).
• Restream and Webhooks: see chapters 9 and 13.
• Picture and sound: logo, deinterlacing, shape, encoder hardware and preset, volume and audio track for the renditions (shown when the server can transcode).
• Settings: viewer limit, segment length, RTMP playback, HLS packaging, DASH, the audio-only variant, the ABR ladder, ad markers, recording, DVR and the HLS and DASH delivery options.
• Recordings: every recorded broadcast, with play, download and clip tools.

Server

Figures for the whole machine (live streams, viewers, applications, data sent and received since start), then Engine version, Running for, Load, Memory, Disk, Processor threads and Transcoding, which says where renditions are made: NVIDIA NVENC (with each card's encoder sessions), Quick Sync, or the processor. Below are the server-wide graphs and Software, where updates live (chapter 14). Before and after the switch, a card about the move sits at the top with the switch buttons.

05 Publishing and ingest

The Connect your encoder card gives everything an encoder needs. An application accepts up to eight streams on the air at once, each under its own stream name; new applications suggest livestream, and imported ones keep whatever names your encoders already send.

The card shows the exact addresses for each application; use those. SRT moves to UDP 9999 and RTSP to 5554 when another program holds the usual port, and the card follows. Single-field encoders such as OBS and FFmpeg take the SRT URL; vMix, Haivision and hardware encoders take the SRT server and Stream ID separately.

Encoders with only a stream-key field

Streamlabs, phone apps and some hardware cannot answer a user-name-and-password challenge. Tick Encoders put the password in the stream key on the card, then give them <stream>?password=YOUR PASSWORD as the key. Encoders that do offer a user name and password keep working.

Pulling instead of publishing

Two ways, both under the application. Read the stream from a camera or another server instead makes the application's whole source a pull, with up to four backups tried in order while it fails; viewers keep the same stream through a short drop and Cue goes back to the main source when it answers. Streams from elsewhere adds pulled streams next to what encoders publish, each under its own name, with up to five addresses and Read it only while someone watches for on-demand pulls. Accepted sources: rtsp://, srt://host:port?streamid=…&passphrase=…, HLS, udp:// (multicast too), tshttp:// and rtmp://.

06 Outputs and players

The Watch card lists every address the application plays at. They are built from the server name in Settings, and they read livestream: if your encoder publishes another stream name, put that name in its place.

HLS packaging and latency

Under the application's Settings, HLS packaging offers MPEG-TS (plays in every player), fMP4 / CMAF and Low-Latency HLS (fMP4, 2-3 s behind live). Segment length is 2, 4, 6 or 10 seconds; shorter segments lower the delay. Saving restarts the stream's packaging, so viewers reconnect once. Audio-only variant adds an audio rendition for listeners on cellular (fMP4 and Low-Latency only).

Delivery options

The HLS and DASH delivery group adds I-frame playlists for scrubbing, timed ID3 from the encoder's onTextData/onCuePoint, CEA-608 captions and teletext as WebVTT subtitles, gzip for playlists, HLS encryption (AES-128 (whole segments) or SAMPLE-AES (MPEG-TS, Apple), with key rotation), a path prefix for use behind a proxy, and extra response headers. Encryption covers HLS only and cannot be combined with DASH or Low-Latency HLS.

07 Transcoding and ABR ladders

By default Cue repackages what arrives without re-encoding it. Give an application an Adaptive bitrate ladder and it also makes lower renditions, aligned on the same segment boundaries, which players switch between by connection and screen:

• Off: the source only
• HD: source, 720p, 480p, 360p
• SD: source, 480p, 360p
• Mobile: source, 360p, 240p

The source is always offered as it arrives, and no rendition is made at or above its height. A custom ladder of up to five renditions can be set through the API; the console then shows it as Custom.

Choosing the hardware

The application's Picture and sound card has Encode on:

• Automatic (NVIDIA NVENC, then Quick Sync, then the CPU), the default.
• NVIDIA card (NVENC), with an optional card number as nvidia-smi counts them; left empty, the least busy card.
• Quick Sync / VA-API: Intel graphics, on Linux. Cue does not use Quick Sync on Windows.
• The CPU, with an Encoder preset from ultrafast to veryslow (veryfast by default; slower is sharper and costs more processor).

The same card adds a PNG logo in a corner (up to 256 KB, with height and opacity), deinterlacing for 1080i or 576i sources, a target shape (16:9, 4:3, 1:1, 9:16) with fit, fill or stretch, a volume change in dB, the audio track to use, and the source's bitrate when it is re-encoded. These apply to what HLS and DASH viewers get; RTMP, SRT, RTSP and WebRTC carry the stream as it arrives.

Renditions need FFmpeg on the server. The Transcoding line on the Server page tells you what the server can do; if it reads not available (FFmpeg is not installed), ask us and we will add it. Where your ladder is made is shown under the preview, for example Renditions: 720p, 480p, 360p · made on Quick Sync.

08 Recording, DVR and clips

Recordings are kept on the server's own storage, in a store Cue installs alongside itself. In the application's Settings:

• Record every broadcast, and Keep recordings for 7, 30 or 90 days, a year, or until I delete them.
• Record only at these times (empty: whenever live): one window per line, such as mon-fri 09:00-17:00 or sun 10:00-12:30, in the time zone you pick beside it. daily, weekdays and weekends work too.
• Let viewers rewind (DVR) and How far back, from 30 minutes to 30 days. Players rewind at the HLS with rewind address; sites already built around index-<from>-<seconds>.m3u8, timeshift and archive addresses keep using them.

The Recordings card lists each broadcast with its length and size: Play, Download, MP4 (the same recording as one MP4 file), Save a clip (a stretch, given as minutes:seconds, saved as an MP4 in the application's media library) and Delete.

Video-on-demand applications are not imported yet. On-demand libraries, playlists and 24/7 channels played from files are services of the Cue Reseller Panel, where your licence includes it (chapter 15). If your previous server plays video files today, tell us before the switch.

09 Restreaming

The Restream card sends the application's stream on whenever you broadcast, to up to five targets. Add a target offers presets for YouTube and Facebook (both over RTMPS) and Twitch, where you paste only the stream key; Other RTMP server for any rtmp:// or rtmps:// address with its key; and SRT or UDP (MPEG-TS) for an SRT listener or a UDP destination, multicast included. Each target shows its state (Waits for your broadcast, Connecting, Sending, Retrying with the last error) and can be switched off without deleting it. Keys are stored sealed and shown masked.

10 SCTE-35 and ad breaks

SCTE-35 cues arriving over SRT or MPEG-TS, and RTMP data messages that carry a cue (onCuePoint, onCUE and similar), are kept. The application's Ad markers in HLS setting chooses how they appear: #EXT-X-CUE-OUT / CUE-IN (the default), #EXT-X-DATERANGE (SCTE35-OUT/IN), Both or Off. Segments are cut at the splice point in the source and in every ladder rendition, so an ad decision service such as AWS MediaTailor or Google DAI can replace exactly the break. DASH carries them as an EventStream. The Watch card counts the cues it has seen and shows the last.

To start a break yourself, without a cue from the encoder, use the API (how-to).

Server-side ad insertion inside Cue itself (VAST ads stitched into each viewer's stream) is a feature of the Cue Reseller Panel's services, where your licence and plan include it.

11 Securing streams

Who may publish

Keep Require a password to publish on. New password on the encoder card replaces the password; the running encoder keeps streaming until it reconnects, then needs the new one. Repeated wrong passwords from one address are slowed down.

Who may watch

The Who may watch card is checked when a viewer starts, on every protocol including the thumbnail; nobody already watching is cut off. Leave it empty to let anyone watch.

• Sites that may embed the player, with Refuse players that do not say which site they are on for a strict lock (apps and set-top boxes send no site, so they would be refused).
• Blocked addresses and Only these addresses, as addresses or ranges such as 203.0.113.0/24.
• Countries: every country, only these, or all but these, by two-letter code. This needs the server's country database, which it downloads by itself.
• Signed links: Cue signed link or one of the two other common signed-link formats, with a Shared secret, and A link works only from the viewer's address to bind a link to one viewer. If your website already signs links, pick the format it uses and paste its existing secret: the links your site makes keep working. Make a test link gives you a one-hour link to try.

Your own decision service

Authorization backend takes an on_play and an on_publish URL, using the widely used on_play/on_publish protocol: viewers are a GET, publishers a JSON POST, 200 lets in and 403 keeps out. An existing backend answers Cue as it is, including X-AuthDuration, X-UserId and X-Max-Sessions. If it does not answer within 3 seconds, a running session keeps its last verdict and a new one is refused.

DRM and paywall

FairPlay and Widevine DRM, with your own Apple and Google credentials, and a paywall paid into your own Stripe account, are features of the Cue Reseller Panel's video services (Paywall & DRM), where your licence includes them. The Cue Media Server console's protection is the set above plus HLS encryption.

12 IPTV and the guide

When the IPTV service is part of your server, the IPTV page runs subscriber delivery in the standard IPTV panel format that every IPTV app speaks. Its tabs are Overview, Lines, Channels, On demand, Bouquets, Guide, Resellers, Activity and Settings.

• Lines are subscribers: user name and password, expiry, how many devices at once, trial, allowed addresses.
• Bouquets group the channels, movies and series a line may see.
• Guide loads XMLTV programme guides on a schedule; catch-up plays from the DVR recordings at the timeshift addresses IPTV apps expect.
• Subscribers use IPTV Smarters, TiviMate, XCIPTV and similar apps with the server address and their line's login, or the M3U playlist; Enigma2 receivers take the bouquet script, and MAG boxes the portal at /c/ when it is on.
• Resellers sign in to the same console with their own account, see only the IPTV lines, and create and renew lines with the credits you give them.
• Activity shows who is watching now and the recent connections.

13 Stream health, graphs and logs

• Per application: the status pill, the four figures, how the stream arrives (Arriving over SRT, Arriving over RTMP, Pulled from the source), its SCTE-35 cues, the renditions line, and for pulled sources, live, retrying with the error, or live from a backup.
• Viewers and traffic: viewers and Mb/s sent, per application and for the server, sampled each minute, kept 48 hours by the minute and 90 days by the hour. Hover the graph to read a moment.
• Logs › Server log: the engine's last lines, with a filter (an application name, or error) and Follow new lines. Lines with errors, refusals, drops and retries are highlighted.
• Logs › Sign-ins and changes: who signed in, from where, and what they changed.
• Webhooks: up to five per application, POSTing JSON in the common event_sink shape when a stream goes live or ends, a pulled stream connects or goes away, an encoder is turned away, or a recording starts or finishes. An optional signing key adds X-Signature; undelivered events wait and are sent again. Send a test event checks your receiver.

Analytics tools that read a monitoring API or a W3C access log can be pointed at Cue too; ask us to turn the access log on.

14 Settings, users, updates, licence

Settings

• License: Licensed with its key and Valid until. The licence renews itself with our licence server; if that cannot be reached, the server keeps running until the date shown. You will not need to enter a key: we set it.
• Server name: the name or IP address encoders and viewers use. Every address in the console is built from it.
• Playback addresses: http, port 1935 or https.
• HTTPS certificate: Get a free certificate from Let's Encrypt for the server name. Point the name's DNS A record at the server first; the status goes from Working to Trusted, the certificate covers playback over https and the console, and it renews itself. If your previous server used your own certificate, talk to us before the switch.
• Appearance: the name in the header and an accent colour.
• Your password, Two-factor sign-in, Users and API tokens: see chapter 3 and APIs.

Updates

Releases are signed by us, and your server checks the signature and every file before installing. On the Server page, Software shows the version and whether a newer one is out. Schedule the update picks a time within 30 days (it suggests 03:00 your time); Install now does it at once; Check now asks again. Installing restarts Cue: live streams stop for about half a minute, encoders reconnect by themselves, players retry, recordings in progress end and start again, and you sign in again afterwards.

15 The Cue Reseller Panel

Where your licence includes it, the Cue Reseller Panel opens at https://your-server:8443/. It is a hosting control panel built around the engine, laid out like MediaCP, for selling streaming to your own customers:

• Administrator menu: Dashboard, Customers, Services, Paywall, Statistics, Integrations, System Config, Reseller Plans, Email Templates, Stream Events, Announcements, Software Health, Software Updates, Backups and License.
• Services: Live Streaming, TV Station (a 24/7 channel played from uploaded videos on a schedule, which an encoder can take over), Ondemand Streaming (a video library with playlists and an embeddable player), Relay and Radio (Icecast).
• Each service: Overview, Configure, Media Library, Playlists, Schedule, Widgets & Links, Public Page, Stream Targets, GeoIP Country Locking, Secure Links, Paywall & DRM, Stream Events and Reporting, as its type and features allow.
• A MediaCP-compatible API for WHMCS, Blesta, ClientExec and WiseCP modules, white label per reseller, and the interface in thirteen languages.

The server-level pages described in this guide (Server, Logs, Settings, Import) stay at /classic/; a panel administrator's session opens them without a second sign-in. Our Cue Reseller Panel page describes the panel in full.

16 How-tos

Every address below is a pattern: the application's Connect your encoder and Watch cards show the exact one.

srt://your-server:9998?streamid=r=live/livestream,m=publish,u=live,s=YOURPASSWORD&passphrase=YOURPASSWORD

<iframe src="http://your-server:1935/_player/live/livestream" width="640" height="360" frameborder="0" allow="autoplay; fullscreen" allowfullscreen></iframe>

curl -X POST https://your-server:8443/api/v1/channels/c3/cues \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"stream":"livestream","type":"out","duration":30}'

17 Terms you know, Cue terms

If you're used to another streaming server, this is where its ideas live in Cue.

18 What an import carries

The import keeps names, publishing users and passwords, viewer limits, restream targets, pulled sources with their backups, recording and rewind settings, signed-link secrets, authorization backends and webhooks. It shows a note beside every application for anything it adjusts:

• A transcoder becomes a ladder of up to five H.264 renditions; settings it cannot read become the HD ladder.
• Restream targets: RTMP only, five per application. Targets that name each stream need adding by hand.
• A rewind window longer than 30 days, or one sized by disk space, becomes 30 days. Recordings imported as "keep everything" are kept until you set a retention.
• Several publishing users in one file become one; the note says which.
• An authorization backend running on the old server itself has to keep running next to Cue.
• Not imported yet: video-on-demand applications, edge/repeater applications (import the origin) and first-generation secure tokens.

19 APIs

Cue's own API

Everything the console does goes through https://your-server:8443/api/v1/. Make a token under Settings › API tokens › New token: tick the actions it may take (read, write, publish, play), name the applications it covers (* for all, and for server-wide calls) and an expiry in days (0 for never). The token is shown once; only its hash is kept. publish and play tokens are also WHIP and WHEP bearer tokens.

curl -H "Authorization: Bearer YOUR_TOKEN" https://your-server:8443/api/v1/channels

The APIs your tools already use

Cue also answers the management APIs your existing tools and control panels may already use: the REST API on port 8087 and the monitoring pages on 8086, with the same users and passwords as before (HTTP basic authentication), and the stream API at https://your-server:8443/streamer/api/v3/, signed in with a console user or a Cue API token. Applications, publishing security, stream targets, recorders, pulled streams and monitoring map onto Cue's settings. If a call your tool makes is not answered, tell us which.

20 On the server: Windows and Linux

Cue runs on Windows Server 2022 and 2025, and on current Ubuntu, Debian, AlmaLinux, Rocky and RHEL. You never need to touch these files to use Cue; this is for administrators who like to know.

Ports

Commands

In an elevated PowerShell on Windows, or as root on Linux:

cue admin list-users                 # who can sign in
cue admin reset-password admin      # prints a new password for admin
cue admin disable-2fa admin         # lost phone and recovery codes
cue license status                   # the licence as the server sees it
cue update -check                    # is a newer signed release out?

Please leave cue switch to us: it moves the standard ports between Cue and the old engine.

21 Troubleshooting and FAQ

The browser says the console's certificate is not trusted.

Expected until the server has a name with a Let's Encrypt certificate. Accept it for this address, then set a name and turn on Get a free certificate from Let's Encrypt for the server name under Settings.

I signed in at port 8443 and only see a License page.

That is the Cue Reseller Panel, which your licence may not include. The Cue Media Server console is at /classic/ on the same port.

My encoder is refused.

Open Logs and filter by the application's name: a refused publisher means a wrong user name or password, or an encoder that cannot do the sign-in exchange. For the latter, tick Encoders put the password in the stream key. Repeated wrong attempts from one address are slowed down.

The application stays on "Waiting for encoder".

Check the encoder's server address and application name, that port 1935 (or SRT's UDP port) is reachable, and the encoder's own error. Before the switch, test encoders must use port 1936.

Viewers get an error but the application is Live.

Check Who may watch: an embed lock, a country rule or signed links refuse anyone who does not match. Then check Maximum viewers.

No renditions are made.

Look at Transcoding on the Server page. Without FFmpeg, or with no H.264 encoder in it, Cue serves the source only; ask us.

"Countries cannot be allowed or blocked".

The server has not downloaded its country database yet. It does so by itself; try again later.

Restreaming to YouTube says Retrying.

The card shows the last error. Most often the stream key has changed on the platform's side: Edit the target and paste the new key.

Does the switch change my bill?

Questions about your account and invoices are for our support team; this guide covers the software only.

Can I go back to my previous server?

Yes. The old engine stays installed, stopped and disabled, and the switch-back button on the Server page brings it back in about a minute. Talk to us first.

22 Getting help

The engineers who wrote this guide look after the servers it runs on. Ask in the chat on this site, where an AI assistant answers at once and a person takes over whenever you ask, or write to support@serverroom.net. Include the server's IP address and the application's name, and if something misbehaved, the time it happened.