Have connection details from your provider but aren’t sure whether to add a single server or a subscription? Check the link prefix and your provider’s instructions, then use the matching import method. This guide explains the fields in four types of share links, how subscriptions update, and how to verify the connection after importing.
Start by identifying what the link represents
A single-server share link in Shadowrocket typically encodes one server’s protocol, address, port, and authentication details in a single text string. Common prefixes include ss://, vmess://, vless://, and trojan://. The prefix identifies the protocol; it does not mean the link points to a list that updates periodically. Importing a share link usually creates one selectable server entry.
A subscription link is usually a URL that starts with https://. Shadowrocket requests that address, reads the configuration in the response, and creates or updates the server entries under the subscription. Seeing https:// only tells you that the entry point is a web address; the prefix alone does not prove it is a working subscription. Check your provider’s instructions and the response returned by the request.
Four share-link formats: similar prefixes, same purpose, different fields
The examples below show format only; the domains, credentials, and encoded fields cannot be used to connect. Capitalization, encoding, and optional parameters vary by format. Don’t try to “simplify” a link by manually deleting parameters after the question mark. For example, transport and security parameters in a VLESS link may affect how it connects, and a Trojan link’s password can’t be inferred from its display name.
ss://[email protected]:8388#demo
vmess://BASE64_JSON
vless://[email protected]:443?encryption=none&type=tcp#demo
trojan://[email protected]:443#demo
https://example.com/sub?token=xxxxThe first four lines illustrate single-server share links; only the last line illustrates a subscription URL. example.invalid and example.com are shown for format only, and xxxx is not a valid credential. 443 and 8388 are example ports, not values required by a particular protocol in Shadowrocket. Use the port provided by your own provider.
- Shadowsocks:
ss://commonly includes the encryption method, password, server address, and port. Some fields are encoded, so a password that isn’t visible in plain text may still be included in the link. - VMess:
vmess://commonly carries encoded configuration data. A long string of characters is normal for this format; its completeness can’t be judged by visible length alone. - VLESS:
vless://typically includes a user ID, address, port, and optional query parameters. Fields such astypeaffect connection settings. - Trojan:
trojan://typically includes a password, server address, and port, and may also include other connection parameters. The name after the final#is mainly for identifying the entry; it does not replace the connection fields before it.
How to tell: check the provider’s stated purpose for the link
If the details are for a single server share link, add one entry using the relevant protocol. If they’re for a subscription URL that updates periodically, add it through Subscribe. A subscription response may contain entries such as ss://, but that doesn’t make the subscription URL itself a server entry.
How to import each type in Shadowrocket
Before you begin, confirm that Shadowrocket is listed on its App Store product page, with Shadow Launch Technology Limited as the developer and app ID 932747118. It’s a paid app for Apple platforms; check the App Store page for system requirements. Purchasing the app and getting connection details from your provider are separate things. Buying the app does not create a usable server entry.
Choose the add method for your connection details
If you have a single-server share link
- Copy the entire text starting with
ss://,vmess://,vless://, ortrojan://. Don’t leave out any trailing parameters. - Use the add option in Home and check whether the current interface offers clipboard import. To add a server manually, go to
Home → + → Type, select the correct protocol, and enter the fields using your provider’s details. - After saving, return to Home and check the new entry’s name, protocol, and server address, then select it.
If you have a subscription URL
- Copy the full URL your provider identifies as a subscription, including its query parameters.
https://example.com/sub?token=xxxxis an invalid example for illustration only. - Go to
Home → + → Type → Subscribe, enter the address in the URL field, choose a recognizable name, and save. - Return to Home, check that the subscription appears, and use the update option shown in the interface to fetch its entries.
Importing successfully does not establish a connection. You still need to select a server, check Global Routing, and verify the result with Connectivity Test.
The add options and clipboard actions may vary with the current app interface. If a quick-import option isn’t available, use the visible Type option and its fields. Don’t paste an entire ss:// link into the Subscribe URL field. Likewise, don’t enter a subscription URL in a single server’s address field: that field needs the hostname or IP provided by your provider, not a subscription URL with a path and token.
- Select the server you just imported in Home. If you imported a subscription, first choose one of the entries it created.
- Check
Global Routing.Directsends traffic directly. To test basic connectivity through the selected server, useProxyif appropriate. For day-to-day rule-based routing, also checkConfigand which rules match. - Turn on the connection switch and follow the system prompts to authorize the VPN configuration, then run
Connectivity Test. Check the test result separately from how the target website behaves; the switch being on does not confirm that the connection details are correct.
Updates: reimport a single link, refresh a subscription
A single-server share link is more like a one-time configuration snapshot. The server entry you import won’t automatically sync a new address, password, or port if the original share text changes at your provider. If your provider gives you a replacement link, compare the old and new fields, then reimport it or edit the entry using the new details. Confirm the replacement works before cleaning up the old entry to avoid selecting the wrong one when names match.
A subscription keeps a URL that can be requested again. When your provider changes the entries returned at that URL, you can update the subscription in Shadowrocket. After a successful update, check that your selected server is still there, whether its name has changed, and whether the connection you need still works. Update frequency and response content depend on your provider; saving the subscription URL does not guarantee that a server will remain available indefinitely.
Single-server share link
Saves one server configuration directly. When the details change, reimport or edit it using the new information from your provider.
Best for: maintaining one fixed entry and checking its address, port, and credentials individually
Subscribe
Keeps an updateable entry point; the subscription response manages its server entries. Check the entries and selected server after each update.
Best for: when your provider explicitly supplies a subscription URL and its entries need to reflect changes to the provider’s details
Key takeaway: keep details you can verify before updating
Note the name and protocol of the server you’re currently using before updating the subscription. If the connection acts up afterward, first check whether the selected entry changed, then check whether the subscription request succeeded. Don’t immediately change all the connection fields.
A subscription update changes the server details returned by the subscription; it does not change the Global Routing mode or fix rule configuration. For example, in Config mode, requests may be evaluated against rules first. Even after a server record is updated, a domain may still connect directly because of a rule. Check whether the details were updated and whether traffic is using the selected server as two separate steps.
Troubleshoot by symptom when importing or updating
When troubleshooting, keep a complete copy of the original link and check it only on your own device or through a trusted provider channel. If you received text that starts with a protocol prefix, check for extra line breaks or missing query parameters from copying. If you received a URL, first confirm whether it’s a subscription entry point, an account webpage, or a page that displays details for a single server. URLs for different purposes are not interchangeable.
After pasting an https:// address, only one entry appears and it won’t connect?
First check whether you entered a subscription URL in a server address field. Go to Home → + → Type → Subscribe and enter the subscription address specified by your provider in the URL field. Once you’ve checked it, you can clean up the incorrectly added entry.
After importing vless://, the entry appears but won’t connect?
Compare the entry with the original details from your provider. Check the host, port, and all parameters after the question mark, especially fields such as type. Then confirm you’ve selected the entry you just imported. An entry appearing only confirms it was created; it doesn’t mean the server is reachable.
The subscription updated, but you’re still using the old server?
Return to Home and check the currently selected entry. Review the new entry’s name and address under the subscription, then select the one you want to use. If the list hasn’t changed, check whether the subscription URL is still valid and review the update result shown in the current interface.
The connection switch is on, but the target website still isn’t using the server as expected?
Run Connectivity Test first, then check Global Routing. With Direct, requests aren’t routed through a proxy. With Config, check whether the relevant rule matches. Reimporting a link won’t fix a routing-rule issue.
To understand the rules, start with the matching scope of DOMAIN-SUFFIX, GEOIP, IP-CIDR, and FINAL: the first three cover domain suffixes, geographic locations, and IP ranges, respectively; FINAL handles requests that didn’t match an earlier rule. These rules control where requests go. They don’t turn a single-server link into a subscription or correct invalid authentication details. Troubleshoot in this order: confirm the type of connection details, check the imported entry, run a connectivity test, and then check the rules.
Continue checking where to get Shadowrocket and how to import
Confirm the App Store listing on the authenticity check page, then follow the guide to review Home, Subscribe, and Global Routing. Purchasing the app and getting your own connection service are separate things.
Visit the App Store listing check Read the guide