What a subscription link actually is
A subscription link (subscription URL) is an HTTPS address that returns a configuration file rather than a web page. Only once the client has that file does it know which servers to connect to, which protocol to use and which routing rules to apply. Servers are the individual parameters; the subscription link is the entry point that delivers the whole set — don't conflate the two.
The difference from a single-server link comes down to count and maintenance. A string starting with ss://, vmess://, vless:// or trojan:// describes exactly one server, so copying ten of them gives you ten servers. A subscription link is a single URL that carries the entire group. When the service adds routes, retires a server for maintenance or changes an entry point, the client syncs by pulling the subscription again — no replacing links one by one.
The return format depends on the client. Clash and mihomo-family clients read YAML, sing-box reads JSON, v2rayN and v2rayNG read a Base64-encoded list of server links, and Shadowrocket handles both. That's why panels usually offer several copy buttons; the classic symptom of picking the wrong one is “import succeeded, but the server list is empty”.
Besides servers, a subscription usually carries routing rules (which domains connect directly, which go through the proxy), DNS settings, and a response header called subscription-userinfo holding used traffic, total traffic and expiry date, which the client turns into a remaining-traffic display. If the panel and the client disagree, update the subscription manually once and look again.
On VPNPX, for example, one subscription link stands for all of this:
Where to find the subscription link in the user panel
The subscription link only shows up in the user panel after you sign in — marketing pages never carry it. Getting it takes five steps:
- Open the panel URL and sign in with your username and password. VPNPX doesn't require an email address — username plus password is enough — so this link is effectively your account credential: whoever holds it holds your configuration.
- After signing in, go to the overview page and find the Subscription section. It shows the current plan's traffic and expiry date.
- Choose the format that matches your client: YAML subscription for Clash, mihomo and Clash Verge Rev; universal (Base64) subscription for v2rayN, v2rayNG and Shadowrocket.
- Click Copy subscription link and paste it into a plain-text editor to verify it: the URL must not wrap across lines or contain spaces, and the
tokenparameter at the end must be complete. - Import it and connect once straight away; close the panel only after you've confirmed it works. If the import fails, copy the link from the panel again rather than repeatedly changing client settings.
A subscription link typically looks like https://example.com/sub?token=xxxx. The token is part of your account credential, not random decoration, so treat the link like a password: don't post it in group chats, don't commit it to public repos, don't screenshot it for others.
How to import on five platforms
The five platforms use different paths for the same action: hand one URL to the client and let the client fetch it. The table below shows where that entry point lives in common clients.
| Platform | Common clients | Import entry point | Where it usually gets stuck |
|---|---|---|---|
| Windows | Clash Verge Rev、v2rayN | Config → Import from URL; in v2rayN, Subscription group settings → Add | Imported but never set as the active profile |
| Android | Clash Meta for Android、v2rayNG | Config → New → Import from URL; in v2rayNG, add it, then update from the main screen | Battery optimisation kills the background process |
| iOS | Shadowrocket、Stash | + in the top-right of the home screen → choose Subscribe → paste and save | Saved without triggering an update, so the list stays empty |
| macOS | ClashX Meta、Stash | Menu bar icon → Config → Managed config → Add managed config | Network permission must be allowed on first connect |
| Linux | Clash Verge Rev, mihomo core | Same GUI as above; on the command line, pull with curl and reload the core | Match the core package to your CPU architecture |
Desktop: Windows and macOS
In Clash Verge Rev, create a profile on the Profiles page, choose Import from URL, paste and import, then select it in the profile list. In v2rayN, add the address under Subscription group settings first, then return to the main window and click Update subscription — both steps are required. On macOS, ClashX Meta goes menu bar icon → Config → Managed config → Add managed config, and the first connection needs network permission in System Settings. The most common desktop failure is importing a profile and never making it active, so the main window keeps showing the old servers.
Mobile: Android and iOS
In v2rayNG, open Subscription group settings from the side menu, add the link in the top-right corner, then go back to the main screen and tap Update subscription. In Clash Meta for Android it's Profiles → New profile → Import from URL. On Android you also need to allow the app to keep running in the background in system settings, otherwise the connection drops after a while in the background. On iOS, Shadowrocket uses + in the top-right of the home screen, type Subscribe, paste and save, then go back and trigger an update on the subscription entry before servers appear in the list — “saved but no servers” almost always means this step was skipped.
Linux: pull from the command line
With no GUI, use curl to write the subscription content straight into the core's config file, then reload the core:
curl -fsSL "https://example.com/sub?token=xxxx" -o ~/.config/mihomo/config.yaml
chmod 600 ~/.config/mihomo/config.yamlAfter the pull finishes, restart the service or hit Reload config in the client so the new servers take effect. Setting the file permissions to 600 keeps other accounts on the same machine from reading the token inside. With the Clash Verge Rev GUI, the steps are the same as on Windows.
If the client can't fetch the subscription, retry on a different network first (switching from Wi-Fi to mobile data, for example), then check whether a chat app truncated the link or padded it with spaces. Only after ruling those out should you suspect the client version.
How often to update
Subscription content doesn't change in real time. It changes only when the service adds routes, retires a server for maintenance or adjusts routing rules — on some days it doesn't change at all. Most clients auto-update once a day by default, which is enough for everyday use; manual updates usually live in the profile list's dropdown or behind an Update subscription button.
Four situations call for an immediate manual update: you changed your plan in the panel and traffic or permissions changed; you reset the subscription link; a region's servers disappeared from the list; or connection quality dropped noticeably. Conversely, updating before every connection achieves nothing — one extra request doesn't make a route faster.
Updates flow one way: whatever the server returns wins. That means local edits to rules, DNS or ports are replaced wholesale on the next update.
To keep your own changes long term, use the client's override and extension mechanisms (Merge in Clash Verge, proxy-providers and rule-providers in mihomo) and put hand edits in the override layer instead of editing the config generated from the subscription. Otherwise you redo them on every update.
Bottom line: let the client handle the daily auto-update, add a manual update once a week as a safety net, and reserve “update right now” for the two cases that need it — a plan change and a link reset.
After a link leak: what to do, in what order
The token inside a subscription link is your account credential: anyone who has the link can pull the whole configuration and burn through your traffic. When a leak happens, order matters more than speed:
- Reset first. Reset the subscription link in the panel so the old token stops working immediately. This comes before anything else — stop the bleeding, then talk about the rest.
- Then replace it device by device. Delete the old profile on each device and import the new link. Replacing only one leaves the rest still pointing at an address that no longer works.
- Then clean up copies. Delete the old link from chat history, cloud notes, screenshots and public repos. It's already invalid, but cleaning up prevents someone using it by mistake later.
- Check your traffic. Compare used traffic in the panel against what you actually used, and contact support if the gap looks wrong.
- Finally, check the account. If the account password leaked along with the link, change it and sign in again on every device.
The order can't be reversed. Reset first, then replace device by device: the leaked link is dead from step one. Delete devices first and reset later, and the old link keeps working in between.
Resetting the subscription link invalidates the old profile on every device at once — that's the cost, and it's also the point. So don't pass the link around in the first place; don't wait for an incident to fix it.
The post-import checklist
A finished import doesn't mean a correct setup. The seven checks below are ordered by three layers — can it fetch, can it connect, can it resolve — so working through them usually shows which layer the problem sits in.
- ✅ The client shows the full server list, and the count matches the panel.
- ✅ Selecting a server opens international sites that load completely, not just a headline.
- ✅ Remaining traffic in the client matches the panel, which means the usage data in the subscription was read.
- ✅ Routing rules work: local sites connect directly, domains that need acceleration go through the proxy.
- ❌ Empty server list: usually the wrong subscription format — go back to the panel, copy the other format and re-import.
- ❌ A 401, 403 or “subscription expired” message: the token is invalid — copy it again or reset it, then re-import.
- ❌ It connects but pages won't open: check the system clock first, then whether the client's DNS settings are being overridden by the local network.
An empty server list is a fetch-stage problem; “connects but pages won't open” is a resolution problem after the connection is up — the two causes sit on different layers. For fetch failures, check the link itself first; for connection failures, check the clock and DNS first. Splitting the two is far faster than swapping servers at random.