This guide uses the Shadowrocket interface on iPhone and iPad as its reference and is for users who already have their own provider details and subscription link. First, distinguish a server subscription from a Config rules profile, then choose Subscribe, Add Server, QR code, or clipboard import. Finally, check the list, update results, and Connectivity Test to verify the import and connection separately. On other platforms, look for the same features in the interface rather than assuming the mobile button locations are identical.
First, distinguish Subscribe from Config
On iPhone and iPad, a server subscription and a rules profile are different kinds of data. A server subscription retrieves server entries; Config manages rules profiles. If a link is described as a “configuration link,” check what it actually returns before choosing where to import it. This guide does not provide, sell, or recommend servers or subscriptions; all steps assume you already have your own details.
On iPhone and iPad, adding a server subscription usually starts at the “+” in the top-right corner of Home, then Add Server, where you set Type to Subscribe. Not every subscription operation takes place by pasting a link into Config. Remote profile management in Config serves a different purpose from server subscriptions; even if both use HTTPS URLs, they are not interchangeable.
- Server subscription: Usually an HTTPS URL whose response contains importable server details. The URL alone generally does not tell you whether the response format is compatible.
- Single-server share link: May start with
ss://,vmess://,vless://, ortrojan://. It contains details for one server and is not a regular webpage URL. - Rules profile: May contain sections such as
[General]and[Rule]. Importing it as a server subscription does not replace selecting and enabling a profile in Config.
Subscribe: Import an existing subscription and check the list
On iPhone and iPad, Subscribe keeps the subscription source and retrieves its entries when you already have a compatible server subscription. The example URL below is fictional and cannot connect. When entering your own link, use it in full, including query parameters; do not omit a token or change capitalization.
https://example.com/sub?token=xxxx-
Open the Add Server screen
Go to Home → “+” in the top-right corner → Add Server. Make sure this is the server setup screen, not the rules profile editor in Config.
-
Choose Subscribe
Set Type to Subscribe and enter your own subscription URL. If the screen has a remarks field, use a recognizable label; do not put credentials in the label.
-
Save and retrieve
Check that the URL has no leading or trailing spaces, line breaks, or missing query parameters, then save it. Return to Home and wait for the subscription to load. To try again, use the subscription’s update action or pull to refresh.
-
Check the entries
Expand the subscription and check whether server entries appear, then select one of the existing entries. Seeing the subscription name alone does not mean its contents loaded successfully or that the VPN is connected.
Add Server: Enter each protocol’s details instead of pasting a whole subscription
On iPhone and iPad, use Home → “+” → Add Server to enter details manually when you only have a server address, port, and authentication fields. Set Type to match your existing details. The fields for Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard are not interchangeable; changing Type alone cannot convert one set of credentials to another protocol.
Type：Subscribe
RecommendedIf you already have a compatible subscription, this option preserves its source and lets you retrieve list changes through updates. “Recommended” refers only to the procedure for users who already have a subscription; it does not endorse any service.
Best for: A complete subscription URL that you’ll need to update later
Type: Select the specific protocol
In Add Server, choose the protocol specified by your details, then enter the address, port, authentication, and transport parameters in their respective fields. A manually added entry does not automatically receive new parameters when the original subscription changes.
Best for: Complete details for one server that you need to check field by field
Fictional Trojan example
- Type
- Trojan
- Address
- example.com
- Port
- 443
- Password
- example-password-not-valid
- SNI
- example.com
This only illustrates how the fields relate; it cannot connect. Use the port, SNI, and TLS settings from your own details.
Manual entry checklist
- Address
- Enter only the hostname or IP address; do not include https://
- Port
- Enter the server port, not the port in the subscription URL
- Authentication fields
- Enter the Password, UUID, or key required by the protocol
- Transport parameters
- Check Path, Host, and SNI against your own details
Whether a field can be left blank depends on the protocol and server configuration. Repeatedly switching protocols is not a substitute for checking the details.
When entering details on any platform, TLS SNI and the transport-layer Host may serve different purposes. Even if your details give the same value for both, enter it in each corresponding field. If you see a certificate error, first check the hostname, device clock, and whether the details are still valid; disabling certificate verification is not a routine fix.
QR codes: Check what the code contains first
On iPhone and iPad, the scanner at the top of Home reads QR code content. A QR code is only a way to carry text; it does not guarantee that the content is server details. The result might be a single-server share link, a subscription URL, or just a webpage. Check what was recognized before deciding whether to save it.
- Open the QR code you already have on another device. Keep the image sharp and all four corners visible; do not crop it down to just the center.
- Open the scanner from Home. The first time you use it, grant camera access when prompted by the system. If the camera is unavailable, check Shadowrocket’s camera permission in system settings.
- After scanning, check the protocol type or URL. A single-server link should open the corresponding server details for review. For an HTTPS URL, determine whether it is a subscription or an ordinary webpage.
- After saving, return to Home and check for the new entry. If scanning only opens a webpage without creating an entry, do not keep scanning; check the original instructions to confirm what the QR code is for.
Clipboard: Copy the full link, then check what was recognized
On iPhone and iPad, clipboard import is useful when you already have a share link as text. Copy the plain text, then open Shadowrocket; if a read or import prompt appears, check the content and confirm. Whether the system asks for paste permission and whether the app recognizes the link automatically depend on system permissions and the interface. No prompt after opening the app does not mean the link is invalid.
- Copy the full text: Do not copy only the visible portion of a URL shortened in a chat app. You can use text selection to check that the trailing parameters are present, but do not submit the link to an external website for inspection.
- Handle paste permission: If the system asks whether to allow pasting, confirm the source and allow it. If you denied permission earlier, check the app’s paste permission in system settings.
- Confirm the type: Check the server fields generated from a single-protocol link. If an ordinary HTTPS subscription URL is not recognized automatically, go to Home → “+” → Type → Subscribe and paste it into URL.
- Check after saving: Confirm the entry in the Home list instead of relying on a prompt disappearing. Before importing again, check for existing entries to avoid duplicates from the same source.
On any platform, trailing line breaks, full-width punctuation, and extra text added by chat apps can interfere with parsing. Copy the original link again rather than deleting encoded characters that look complicated; percent encoding, slashes, and equals signs may all be valid parts of the URL.
After import, verify three things: the list, the connection, and the rules
On iPhone and iPad, “Import complete” only means the details were saved or parsed; it does not mean the connection succeeded. Check the Home list first, then run Connectivity Test, and finally check how actual requests are routed. The first connection may trigger a system request to add a VPN configuration; review and grant the required permission to establish the connection.
| Check | Where to look | What it does—and does not—confirm |
|---|---|---|
| Details parsed | Subscription group and server entries on Home | Entries mean the data was parsed; they do not prove the server is currently reachable. |
| Connectivity test | Home → Connectivity Test | The result depends on the test method and does not replace testing an actual request. |
| Routing | Home → Global Routing | Config, Proxy, Direct, and Scene are routing modes, not subscription formats. |
On iPhone and iPad, when Global Routing is set to Config, requests follow the rules in the currently enabled profile. Proxy generally routes traffic the app can handle through the proxy policy; Direct connects without a proxy, while Scene follows the configured scene. When troubleshooting, note the original settings, change one thing at a time, and restore them after testing. Do not replace the subscription, rules, and routing mode all at once.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
GEOIP,CN,DIRECT
FINAL,PROXYOn platforms that use Config, the following describes rule syntax; it is not a complete profile you can use to replace an existing file. Rules are matched from top to bottom: DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches address ranges, GEOIP matches by IP address geolocation, and FINAL belongs at the end as a fallback. Updating a subscription does not fix an incorrect rule order, and a rule not matching does not mean the subscription URL is faulty.
Troubleshooting update failures and common issues
On every platform, a subscription update requests the source again and parses its response; a server connection uses an entry that has already been saved. These are separate processes. Old entries may remain after an update fails, so note the current list and error message first. Do not immediately delete the whole subscription or keep tapping Update instead of finding the cause.
Subscribe is saved, but no servers appear in the list. What should I do?
First, check that the URL is complete, then review the update result. A login page, HTML error page, or unsupported format cannot produce server entries, even if the HTTPS request succeeded. If you see HTTP 401 or 403, first check the access credentials and authorization status; for 404, check the path. Use the response and the original service instructions to determine the specific cause.
The subscription updates, but Connectivity Test fails. What should I check?
Troubleshoot subscription retrieval and server connectivity separately. First check the selected entry, port, protocol parameters, device time, and current network, then compare test results for other existing entries. A subscription URL using HTTPS on port 443 does not mean every server also uses port 443.
Entries changed or manual edits disappeared after an update. Why?
Subscription contents depend on the response from their source, and an update may rebuild entries. Record any personal adjustments you need to keep, and distinguish subscription-generated entries from standalone manual entries. Do not assume manual changes will permanently override later updates, or conclude that the app lost data just because the entry count changed.
How can I check whether the connection will resume automatically after import?
On iPhone and iPad, first check Settings → On Demand, then verify the on-demand connection status in the system VPN settings. On Demand controls whether a connection is established when its conditions are met; it does not fix subscription content. If you need to turn it off temporarily while testing an import, note the original conditions and restore them afterward if needed.
- Follow this order: identify the data type → check the import method and fields → review the update result → test an existing entry → check routing rules.
- When asking for help, share redacted error text, the import method, and the steps you took. Remove URL query credentials, Passwords, UUIDs, private keys, and QR code contents.
- When retesting on a different network, note the network conditions. Do not generalize from one successful or failed test to all network environments.