Hi,
i am unable to lock a stream using your tutorial.
I am getting a stream though mpegts and i am outputting it at x/y (application/streamname)
then i am enabling the paywall, create a new group, apply it to my server, and set the application as x in the tutorial.
then i set a password in the bottom of the page.

I am then using the php code to generate the media signature.

Problem is, that independent of the signature i created, the streams play fine from everywhere even though I applied the rule.

Also the server log is always stuck and cannot see anything there to debug.
please help.

Probably you put some rules in allow list? For clients in allow list authentication doesn't performed, they are always trusted.
If you want your streams to be played only from player on your page - you should block by referrer, as described here http://blog.wmspanel.com/2016/07/block-http-referer-header-wmsauth.html - is that what you done?

It advices above wouldn't help - please submit ticket via https://wmspanel.com/help , we will check your WMSAuth settings.