Choose a Shadowrocket import method based on what you have: use Subscribe for a subscription URL, Add Server for individual server details, or scan a QR code or import a share link from the clipboard. This guide is for users who already have their own provider and subscription. It covers where to find each option, how to check the details, update subscriptions, and test the connection. A successful save does not mean the server is working.
01 Identify the subscription URL, share link, or server details
The four options differ in the format of the information you provide, not in their connection capabilities. Subscribe saves a subscription source and retrieves its server list when updated. Add Server saves an individual server configuration. QR code scanning and clipboard import simply pass encoded details to the app for recognition. A QR code may contain either a server share link or a subscription URL, so check what it contains before importing.
Before you start, have your existing connection details ready and confirm whether they are for a subscription or a single server. Don't identify the type based on link length, and don't mistake your provider's account login page for a subscription URL. Subscription URLs typically include access credentials, and share links may contain a password or UUID. Treat both as sensitive information.
| What you have | Where to add it | What to check after saving |
|---|---|---|
| Subscription URL from your provider | Home → + → Type → Subscribe | Subscription group and its server list |
| Address, port, and authentication details | Home → +, then Add Server | Type and connection details |
| Server or subscription QR code | Scanner icon in the top-left corner of Home | Type and contents of the scan result |
| Complete server share link | Copy it, return to Home, and follow the import prompt | Server address, protocol, and additional parameters |
02 Subscribe: Add a subscription and retrieve its server list
If you already have a subscription URL, use Subscribe instead of entering each server returned by the URL manually. Tap + in the top-right corner of Home, open Add Server, select Subscribe under Type, then enter the URL. The example below uses placeholder values and won't connect to a server:
https://example.com/sub?token=xxxx-
Open the add screen
Go to Home, tap + in the top-right corner, open Type on the Add Server screen, and select Subscribe.
-
Enter the URL
Paste your complete subscription URL into URL. Check its beginning, path, and query parameters. Don't include chat text, quotation marks, or line breaks.
-
Save the subscription
Add a recognizable label and save, then return to Home to check the subscription group. If no content appears after the first attempt, check your network and make sure the URL is valid.
-
Update and verify
Pull down on Home to refresh the subscription and check whether servers appear in the group. Select one and run a connection test; a save confirmation doesn't prove the server is usable.
Updating a subscription retrieves its source again. It does not extend an account's validity or fix a remote server. If the response is an account login page, an error message, or unsupported data, the URL isn't a valid subscription just because it starts with HTTPS. Ask your existing provider to confirm the subscription URL and response format for Shadowrocket.
If you need to keep personal changes, make a note of them first. Subscription entries may change when the source is updated, so edits made directly to a subscribed server may not persist. If an update fails, don't immediately delete an older entry that still works—you may need it to diagnose the issue.
03 Add Server: Enter a single server manually
If you only have an address, port, and authentication details, go to Home → +, open Add Server, select the correct Type, and fill in the corresponding fields. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different parameter structures. You can't turn one configuration into another by changing only the server address.
For example, Shadowsocks needs the matching encryption method and password; VMess and VLESS often require a UUID and transport settings; Trojan uses a password and TLS-related settings; and WireGuard requires keys, addresses, and peer details. Use the complete configuration for your existing service. If a field is missing, check with the source rather than reusing values from another server.
Check Shadowsocks fields
- Type
- Shadowsocks
- Address
- Domain name or IP address provided by the service
- Port
- Must match the remote listening port
- Method
- Encryption method must match the remote server
- Password
- Server connection password
The password and encryption method work together. Checking only the address and port isn't enough.
Check Trojan fields
- Type
- Trojan
- Address
- Connection address provided by the service
- Port
- For example, 443—use it only if specified by the source
- Password
- Authentication password provided by the server
- SNI
- Check the TLS server name against the source
Port 443 is a common example, not a default for every server. Don't hide incorrect settings by skipping certificate verification.
When entering Address, a server domain name usually doesn't include https://. Enter the port in the separate Port field, and don't put a subscription URL in Address. If the configuration uses a transport such as WebSocket, check Path, Host, and TLS settings against the details you have. Seeing a server name in the interface only confirms that the entry was saved; it doesn't mean the fields are correct.
- Extra spaces around a password or a missing character in a UUID can cause authentication to fail.
- Address, Host, and SNI serve different purposes. Even when their values happen to match, they aren't interchangeable.
- An address and port alone aren't enough to configure a server without its protocol, authentication, or transport details.
04 QR code and clipboard import: Check the details after importing
Scanning works well when the QR code is displayed on another screen. On Home, tap the scanner icon in the top-left corner, allow camera access when prompted, and scan the complete code. Check the result before importing: if it contains a server configuration, verify the protocol and address; if it's a subscription, verify the URL before retrieving the list. Opening a webpage by itself doesn't add a server.
Clipboard import is useful when you already have the complete share text. Copy only the link, return to Shadowrocket's Home, and review the clipboard recognition prompt before confirming. If iOS asks for paste permission, allow it when you're importing the link yourself. Prompts may appear at different times depending on the system and app state, so no prompt doesn't necessarily mean the link is invalid.
Choose an import method based on where the details are
QR code on another device
- Open the scanner on Home and keep all four corners of the QR code in view.
- Avoid glare, obstructions, and excessive zoom. Check the import type after scanning.
- Verify the label, address, and protocol, then save the entry.
Link on this device
- Copy the complete link, not its description or Markdown formatting.
- Return to Home and confirm the import when prompted to recognize the clipboard.
- If the content is a subscription URL, you can also paste it into the URL field under Subscribe.
QR code and clipboard import change how you enter details. They don't change protocol parameters or fill in information missing from the source.
| Link pattern | Usually indicates | What to check |
|---|---|---|
ss:// | Shadowsocks share link | Check the encryption method, password, and plugin parameters |
vmess:// | VMess share link | Keep the encoded content intact and check the transport and TLS settings |
vless:// | VLESS share link | Keep the query parameters and check the UUID and transport settings |
trojan:// | Trojan share link | Check the password, port, and TLS settings |
https:// | May be a subscription or just a webpage | Check the provider's instructions and the returned content |
A prefix can help identify a link, but it doesn't guarantee compatibility. Share formats vary, and the import result may omit additional parameters. Check each field against the original details. Don't delete anything after the question mark; it may contain transport, security, or server name settings. Don't alter the encoded section just to make the text shorter.
05 After importing: Select a server and check Global Routing
On Home, select the server you want to use, check Global Routing, then turn on the connection. When creating a VPN configuration for the first time, confirm the system prompt. When troubleshooting, distinguish between three states: the server appears in the list, the system VPN is connected, and the target webpage is accessible. The first two don't guarantee the third.
Config
RecommendedUses the active Config rules to determine how traffic is routed. Use it for everyday routing when your configuration is verified; it doesn't mean every request will go through the selected server.
Best for: Routing traffic by destination with a verified rules configuration.
Proxy
Use proxy routing to help isolate issues. If the same destination works under Proxy but not Config, check the rules and policies rather than importing the server again.
Best for: Temporarily separating server connectivity issues from rule issues.
Direct
Uses a direct connection and isn't suitable for testing whether an imported proxy server works. Make sure you switch back when testing is done.
Best for: Comparing access over your current network without a proxy.
Scene in Global Routing refers to a configured scene, not a particular server. If you're using Scene, check the routing settings it actually uses. In Config mode, check the active configuration and matching result under Config, especially the policy applied at the end.
- Compare results using the same destination, changing only one setting at a time. Avoid changing DNS, the server, and the rules all at once.
- A latency test returning a value only means that test received a response. It doesn't confirm that DNS, TLS, or the full webpage request succeeded.
- If the connection turns back on after you disconnect manually, check Settings → On Demand. You can temporarily turn off automatic connection while troubleshooting, then turn it back on when you're done.
06 Common issues: Update failures, duplicate entries, and no import prompt
Why is the server list empty after saving a subscription?
First, confirm the URL is a subscription address, not a login webpage, then pull down on Home to refresh. If you see an authentication error or expired URL, check access with your existing provider. If the request succeeds but no entries are recognized, verify the response format. Saving a subscription record doesn't mean the remote source returned any servers.
The subscription update keeps timing out. Should I turn on the proxy?
First check whether your current network can reach the subscription source. If you already have a working proxy and need it to access the source, check Settings → Subscribe → Update via Proxy. If no server is available, enabling this option won't create a working connection or fix an expired subscription URL.
What if there's no import prompt after copying a link?
Copy the complete original link again. Some chat apps copy only the displayed text. Return to Home and check for the system paste prompt. If you copied an HTTPS subscription URL, go to Home → + → Type → Subscribe and paste it into URL. For an individual share link, check its format and enter the full parameters manually if needed.
A server appears twice. Which entry should I delete?
First distinguish entries in a subscription group from individual entries added by scanning or clipboard import. Compare the address, port, and protocol before cleaning up, and keep entries you still use. Deleting an individual entry doesn't change the remote subscription. Entries from a subscription may reappear after the next update.
I'm connected, but webpages won't load. Should I import the server again?
First check the selected server and Global Routing, then compare the same destination under Proxy and Config. Check the server details, DNS, and rules separately. If you see an authentication or TLS error, compare the settings under Add Server against the original details. If nothing has changed, importing the same link repeatedly usually won't help.
When contacting your existing provider, share which step failed, the exact error message, and the protocol you used. Redact subscription tokens, passwords, UUIDs, and private keys in screenshots or logs. Don't post a complete share link in a public discussion. All four import methods lead to the same configuration details; accurate source information and checking each setting are more useful than repeatedly adding the same entry.