Your streams moved to Cue. Here is your new control room.

Chapter 1Your first ten minutes

1. Open https://your-server:8443/classic/. The /classic/ on the end matters.
2. Your browser will probably complain about the certificate. Cue encrypts the console from day one with a certificate of its own, and browsers only trust certificates issued for a name. Choose to continue to the site. Chapter 14 shows how to swap in a free trusted certificate once your server has a hostname.
3. The sign-in card reads Sign in to manage this server. Type admin (or the user name we agreed) and your password.
4. Turned on two-factor sign-in? You will also be asked for the Code from your authenticator app (or a recovery code).
5. You land on Applications, with one card per channel that came over from your old engine.

Add a second lock: two-factor sign-in

1. In Settings, under Two-factor sign-in, press Turn on.
2. Scan or paste the key into Google Authenticator, 1Password, Authy or any app of that kind.
3. Type the six-digit code and press Turn on again. Write down the recovery codes it shows you: this is the only time you will see them, and each one gets you in once if your phone goes missing.

Colleagues and tools

Give each colleague their own login under Users with Add user. Pick Administrator for people who change things and Read-only for people who only need to look; secrets stay hidden from read-only users. Programs get tokens instead of passwords (chapter 19).

Bought the Cue Reseller Panel too? Then https://your-server:8443/, without /classic/, is your panel (chapter 15).

Chapter 2What's different after the move, and what isn't

Cue is Primcast's own streaming engine. It takes over the job your previous streaming server did, and it was built to look the same from the outside, so the things pointing at your server carry on as before.

Chapter 3How the switch happens

1. Side by sideWe install Cue next to your current engine and import your channels. Viewers are still served by the old engine; Cue listens on test port 1936 and its console on 8443.
2. Your rehearsalLog in, look around, compare your channels. Point a spare encoder at port 1936 if you want to see a stream in the preview.
3. The switchAt the time you booked, we press Switch to Cue. Encoders and players reconnect on their own; plan for one to five minutes of interruption.

If Cue were not to come up, the old engine restarts by itself. Afterwards it stays on the server, stopped and disabled, and the Server page has a button to switch back to it in about a minute. Please talk to us before you press it, so we can fix whatever is bothering you.

Chapter 4Finding your way around

The bar at the top has five entries. IPTV only appears when your server includes the IPTV service. The pages update themselves every five seconds or so.

Inside one application

Click a channel and you get one long page. In order:

1. Stop or Start, and Delete (this also deletes its recordings, and cannot be undone).
2. Live numbers: viewers now, most at once, sent since start, live for.
3. Two graphs of viewers and traffic, for the last 6 hours up to 30 days.
4. Connect your encoder, or Source if the channel pulls its video from somewhere.
5. Watch: a preview window and every link viewers can use.
6. Who may watch, then Authorization backend.
7. Streams from elsewhere, Restream and Webhooks.
8. Picture and sound (when the server can make quality versions).
9. Settings for the channel, and finally Recordings.

The Server page adds machine-wide numbers and lines for Engine version, Running for, Load, Memory, Disk, Processor threads and Transcoding, which tells you whether quality versions come from an NVIDIA card, Intel Quick Sync or the processor.

Chapter 5Going live

Every channel's Connect your encoder box holds the exact server address, stream name and user name to copy into your encoder. The publishing password is not shown there, for safety; it is the one your encoder already uses, or the one you set with New password. One channel can carry up to eight streams at the same time under different stream names.

OBS Studio

1. Settings › Stream › Service: Custom...
2. Server: rtmp://your-server:1935/yourchannel. Stream Key: your stream name, livestream for new channels.
3. Tick Use authentication, then fill in the user name from the console and your publishing password.
4. A keyframe every 2 seconds keeps players happy. Press Start Streaming.

Prefer SRT? Use the same Custom... service, paste the console's SRT URL as the server with your password where it says PASSWORD, leave the key blank, and add &passphrase= plus the password to encrypt the trip:

srt://your-server:9998?streamid=r=yourchannel/livestream,m=publish,u=yourchannel,s=YOURPASSWORD&passphrase=YOURPASSWORD

OBS 30 and newer can also send WebRTC: service WHIP, the console's WHIP URL, and your publishing password as the bearer token.

vMix

1. Open the streaming settings and pick a custom RTMP destination.
2. URL rtmp://your-server:1935/yourchannel, stream name livestream.
3. Enter the user name and password if vMix offers the fields. If there is only a key box, tick Encoders put the password in the stream key on the channel page and send livestream?password=YOURPASSWORD as the key.

For SRT in vMix, set its SRT output to caller, then copy over the host and port from the console's SRT server line and the Stream ID (password filled in), with the password as passphrase if you want encryption.

Wirecast

1. Create an output destination for an RTMP server.
2. Address rtmp://your-server:1935/yourchannel, stream livestream.
3. Set its credentials to your console user name and publishing password, and go live.

Wirecast's SRT output takes the same server and stream ID as vMix does.

Other ways in

• RTMPS: rtmps://your-server/yourchannel, shown once your server plays over https.
• RTSP publishing for cameras and apps such as Larix: rtsp://your-server/yourchannel/livestream.
• A channel fed from elsewhere: Read the stream from a camera or another server instead makes the camera, satellite receiver or remote server the channel's source, with up to four fallbacks Cue tries in turn.
• Extra feeds beside your encoder: Streams from elsewhere (see the recipe "Pull a camera or another server").

Chapter 6Getting your stream to viewers

The Watch box lists the links. They always say livestream; if you publish under another stream name, swap it in.

HLS

Phones, browsers, smart TVs. /yourchannel/livestream/playlist.m3u8, the same address as before.

HLS with rewind

The same, ending in ?DVR, when rewinding is on.

MPEG-DASH

manifest.mpd, once you tick Offer MPEG-DASH.

WebRTC (WHEP)

Under a second behind live, for auctions, betting, two-way shows.

MPEG-TS over HTTP

For set-top boxes and IPTV players.

SRT

For another server or a broadcast partner to collect the stream.

RTSP

For VLC and older systems.

RTMP

Only when Allow RTMP playback is ticked.

Player page

A ready web player at /_player/yourchannel/livestream; the Embed code puts it in your site.

Less delay, or more compatibility

In the channel's Settings, HLS packaging chooses between MPEG-TS (plays everywhere), fMP4 / CMAF and Low-Latency HLS (fMP4, 2-3 s behind live), and Segment length between 2, 4, 6 and 10 seconds. Smaller segments mean less delay. After saving, viewers reconnect once. Radio-style listeners on mobile data can get an Audio-only variant.

Under HLS and DASH delivery you can also switch on scrubbing previews (I-frame playlists), captions and teletext as subtitles, timed metadata from your encoder, compressed playlists, AES-128 or SAMPLE-AES encryption, a path prefix for a reverse proxy, and your own response headers. Encryption is HLS-only: it does not mix with DASH or Low-Latency HLS.

Chapter 7Quality versions and graphics cards

Out of the box, Cue passes your stream through untouched. To help viewers on weak connections, choose an Adaptive bitrate set in the channel's Settings. The player then moves between versions by itself:

• HD: source, 720p, 480p, 360p
• SD: source, 480p, 360p
• Mobile: source, 360p, 240p
• Off: the source only

Your original always stays in the set, and Cue never makes a version as big as or bigger than it. Need your own sizes? Up to five can be set through the API, and the console then shows Custom.

Where the work is done

Encode on, in the Picture and sound box:

• Automatic (NVIDIA NVENC, then Quick Sync, then the CPU): the sensible default.
• NVIDIA card (NVENC): add a card number (as nvidia-smi lists them) on a multi-GPU server, or leave it empty for the least busy card.
• Quick Sync / VA-API: Intel graphics on Linux servers. On Windows Server, Cue uses NVIDIA cards or the processor.
• The CPU, with an Encoder preset: veryfast unless you change it; slower presets look sharper and need more processor.

The same box can burn in your PNG logo (max 256 KB, any corner, adjustable size and opacity), deinterlace 1080i/576i feeds, reshape to 16:9, 4:3, square or vertical, raise or lower the volume, pick an audio track and set the bitrate of your re-encoded original. This affects what HLS and DASH viewers receive.

Chapter 8Recording, rewind and clips

Recordings are stored on your own server. The channel's Settings hold three controls:

• Record every broadcast, kept for 7, 30 or 90 days, a year, or until you delete them.
• A recording timetable, one line per window, for example mon-fri 09:00-17:00, in your chosen time zone. Leave it empty to record whenever you are live.
• Let viewers rewind (DVR) for anything from 30 minutes to 30 days back, at the HLS with rewind link. Websites that use archive links keep working.

Each broadcast appears under Recordings with Play, Download, MP4, Save a clip and Delete. A clip is a stretch you mark in minutes and seconds, saved as an MP4 in the channel's media library.

Chapter 9Sending your stream to YouTube, Facebook and others

Each channel can relay to five places at once while you are live. Under Restream, press Add a target and choose YouTube, Facebook or Twitch (paste the stream key and you are done), Other RTMP server (address plus key), or SRT or UDP (MPEG-TS) for broadcast partners and multicast. A pill shows whether each one is Sending, Retrying (with the reason) or waiting for you to go live; the On tick pauses a target without forgetting it.

Chapter 10Ad breaks

If your encoder or feed marks ad breaks with SCTE-35 (over SRT, MPEG-TS or RTMP), Cue keeps the marks and writes them into your HLS playlists as you choose under Ad markers in HLS: #EXT-X-CUE-OUT / CUE-IN, #EXT-X-DATERANGE (SCTE35-OUT/IN), Both or Off. Video segments are split exactly where the break begins and ends, in every quality version, which is what services like AWS MediaTailor or Google DAI need to swap in ads cleanly. DASH viewers get the same breaks as events.

No markers from your encoder? Fire a break from your own system with one API call: see the recipe "Start an ad break".

Ads stitched into the stream by Cue itself (VAST) come with the Cue Reseller Panel's services, when your licence and plan include them.

Chapter 11Protecting your streams

Stop strangers broadcasting

Keep publishing password-protected. If a password leaks, New password issues another; whoever is on air stays on until they reconnect. Cue also slows down anyone guessing passwords.

Decide who can watch

The Who may watch box is checked each time somebody presses play, on any protocol; people already watching are left alone.

• Allow only your websites to embed the player. A stricter tick refuses players that don't say which site they're on, but that also blocks apps and set-top boxes.
• Block addresses, or allow only certain addresses or ranges.
• Allow or block countries once the server has fetched its country database (it does that on its own).
• Require signed links in Cue's own style or one of the common styles, optionally tied to the viewer's IP. If your site already makes signed links, choose its style and paste the same secret. Make a test link lets you try one.

Have your own login system? Point Authorization backend at it: Cue asks your web service before each viewer (on_play) or encoder (on_publish) gets in, so an existing on_play/on_publish backend needs no changes. If it takes more than 3 seconds to answer, people already watching carry on and newcomers are turned away.

DRM and pay-per-view

FairPlay and Widevine DRM using your own Apple and Google accounts, and a paywall paying straight into your Stripe account, are part of the Cue Reseller Panel's Paywall & DRM page, where your licence covers them.

Chapter 12IPTV subscribers

Servers with the IPTV service get an IPTV page in the standard IPTV panel format, so the apps your subscribers already have can connect. Tabs: Overview, Lines, Channels, On demand, Bouquets, Guide, Resellers, Activity, Settings.

• A line is one subscriber: login, expiry date, number of screens, trial flag, permitted IPs.
• Bouquets decide which channels, films and series each line sees.
• The guide pulls XMLTV listings on a timetable; catch-up TV plays from your rewind recordings.
• Subscribers sign in from IPTV Smarters, TiviMate, XCIPTV and similar apps, or load the M3U playlist; Enigma2 boxes use the bouquet script and MAG boxes the portal at /c/.
• Resellers get their own login that shows only lines, and spend credits you hand out to create and renew them.

Chapter 13Keeping an eye on things

• On the channel page: a pill that reads Live, Waiting for encoder or Stopped; how the video is arriving; the quality versions in use; SCTE-35 marks received; and for pulled feeds, whether the main source or a fallback is playing.
• Graphs: viewers and bandwidth per channel and for the whole server, minute by minute for two days and hour by hour for three months. Point at the line for exact figures.
• Logs: the live Server log with a search box and Follow new lines (problems stand out), and Sign-ins and changes, your audit trail.
• Webhooks: let your own systems hear about streams starting and stopping, feeds connecting, encoders refused and recordings, in the common event_sink format. Up to five per channel, optionally signed, retried until delivered. Send a test event proves the connection.

Using an analytics tool that reads a monitoring API or a W3C access log? Cue can provide both; ask us to switch the access log on.

Chapter 14Account, licence and updates

The Settings page

• License: shows Licensed, the key and the expiry date. We install the key; it renews itself automatically, and if our licence server is out of reach your server runs on until that date.
• Server name: the hostname or IP your encoders and viewers use. All the links in the console are built from it.
• Playback addresses: plain http on port 1935, or https.
• HTTPS certificate: point your hostname's DNS at the server, then tick Get a free certificate from Let's Encrypt for the server name. Within a minute or so the status should read Trusted, the browser warning disappears, and the certificate renews itself. Had your own certificate on the old server? Let us know before switch day.
• Appearance: rename the console header and pick your colour.
• Then your password, two-factor sign-in, colleagues and tokens (chapters 1 and 19).

Updates

We sign every Cue release, and your server refuses anything whose signature or files don't match. The Server page tells you when there is a new version. Schedule the update picks a moment in the next 30 days (3 am your time is suggested), Install now goes straight ahead, Check now looks again. Expect streams to pause for roughly half a minute while Cue restarts: encoders and players reconnect, a running recording starts a new file, and you log back in.

Chapter 15Selling streaming to your own customers

The Cue Reseller Panel is an extra you may have on your licence. It opens at https://your-server:8443/ and works the way MediaCP does, so you can sell live channels, TV stations, on-demand libraries and radio stations under your own name.

• Its menu: Dashboard, Customers, Services, Paywall, Statistics, Integrations, System Config, Reseller Plans, Email Templates, Stream Events, Announcements, Software Health, Software Updates, Backups, License.
• Service types: Live Streaming, TV Station, Ondemand Streaming, Relay, Radio (Icecast).
• Per service, depending on type and plan: media library, playlists, schedule, widgets and links, public page, stream targets, country locking, secure links, paywall and DRM, events and reports.
• Your billing system connects through a MediaCP-style API (WHMCS, Blesta, ClientExec, WiseCP); every reseller can have their own branding; thirteen interface languages.

The server-wide pages in this manual stay at /classic/, and a panel administrator is let in there without logging in twice. More on our Cue Reseller Panel page.

Chapter 17Old words, new words

Coming from another streaming server? Here is what each familiar idea is called in Cue.

You may know it as

In Cue

Application or stream

Application, same name; _definst_ still works in links.

Streams inside an application

Stream names inside the application (eight live at once), same links.

Template with a prefix

An application where encoders choose their own stream names.

Publishing password

Publishing user and password, moved across.

Stream files, inputs

Streams from elsewhere, or the channel's own source with up to four fallbacks.

Transcoder

Adaptive bitrate sets.

Stream targets, pushes

Restream, five per channel.

DVR, archive

Let viewers rewind (DVR), up to 30 days; ?DVR, archive and timeshift links still answer.

Stream recorder

Record every broadcast.

Secure tokens

Signed links, in Cue's style or the common ones, same secret.

SCTE-35 in HLS

Ad markers in HLS.

on_play / on_publish

Authorization backend, identical protocol.

Event sinks

Webhooks, same events and signing.

SMIL / group links

Still answer, with the stream's adaptive playlist.

The old web manager

The Cue console, port 8443.

Management API

Answered by Cue (chapter 19).

Chapter 18What moves across, and what needs a hand

Names, publishing logins, viewer limits, restream targets, pulled sources and their fallbacks, recording and rewind, signed-link secrets, authorization backends and webhooks all come with you. The import screen adds a note to any channel where something changed:

• Transcoder settings become up to five H.264 versions; if they can't be read, the HD set.
• Only RTMP restream targets come across, five per channel; a target that names each stream must be added again.
• Rewind windows over 30 days, or limited by disk space, become 30 days. Imported recordings stay until you pick how long to keep them.
• Where one password file had several users, one is kept, and the note says which.
• A login backend that ran on the old server itself needs to keep running beside Cue.
• Not moved yet: on-demand (VOD) applications, edge/repeater applications (move the origin instead) and first-generation secure tokens.

Chapter 19Scripts and APIs

Cue's API

The console itself runs on https://your-server:8443/api/v1/, so anything you can click, a script can do. Create a key under Settings › API tokens › New token: choose what it may do (read, write, publish, play), which applications it covers (* covers all of them plus server-wide calls) and after how many days it expires (0 = never). Copy it immediately; Cue only keeps a fingerprint. Tokens with publish or play double as WHIP and WHEP bearer tokens.

curl -H "Authorization: Bearer YOUR_TOKEN" https://your-server:8443/api/v1/channels

The API your tools already use

Cue also answers the management API your existing tools may already use. Keep calling the REST API on port 8087 and the stats pages on 8086 with the same users as before (HTTP basic auth), and the stream API at https://your-server:8443/streamer/api/v3/ with a console user or a Cue token. Applications, publishing security, stream targets, recorders, pulled streams and monitoring are understood. If your tool makes a call Cue doesn't answer, send us its name.

Chapter 20The server underneath

Cue runs on Windows Server 2022 or 2025 and on recent Ubuntu, Debian, AlmaLinux, Rocky and RHEL. You can use Cue without ever opening these folders; they are here for whoever looks after the machine.

On Windows Server

• Program: cue.exe in C:\Program Files\Cue, a folder that is already on the PATH.
• Settings file: %ProgramData%\Cue\config.json; the server's secret key beside it in node.key.
• Channels, users and recordings: %ProgramData%\Cue\state. Logs: %ProgramData%\Cue\logs, a file per service.
• Three Windows services: Cue (the engine), CueStorage (the recordings store, reachable only from the server itself) and CueHelper (installs the updates you ask for).
• Firewall: inbound rules grouped under Cue in Windows Firewall. If IIS is running, it keeps ports 80 and 443 and Cue cannot play back on them.

On Linux

• /usr/local/bin/cue; settings in /etc/cue/config.json with the key in /etc/cue/node.key; data in /var/lib/cue.
• systemd units cue, cue-storage, cue-helper and cue-update; logs with journalctl -u cue.
• Firewall rules added by the installer through nftables or firewalld.

Ports to keep open

1935 TCP

RTMP in and out, plus HTTP playback

80 and 443 TCP

Web playback; RTMPS rides on 443

8443 TCP

Console and APIs

9998 UDP (9999 if taken)

SRT

554 TCP (5554 if taken)

RTSP

8189 TCP and UDP

WebRTC

8086 and 8087 TCP

Stats and REST API for your existing tools, where your old server had them

1936, 18086, 18087 TCP

Rehearsal ports while the old engine still serves

Handy commands

Run them in PowerShell as Administrator, or as root on Linux.

cue admin list-users
cue admin reset-password admin
cue admin disable-2fa admin
cue license status
cue update -check

These list the console's users, print a fresh password for admin, remove two-factor from an account whose phone and recovery codes are lost, show the licence, and check for a newer release. cue switch moves ports between Cue and your old engine: please leave that one to us.

Chapter 22Talk to us

The team that looks after your server also wrote this manual. Open the chat on primcast.com: our AI assistant replies straight away and can check things for you, and a person joins as soon as you ask for one. Or email support@primcast.com. Tell us your server's IP, the channel name, and roughly when the problem happened.