How to Import a Shadowrocket Subscription: Subscribe, Add Server, QR Code, and Clipboard

In this article

Choose the right import method for the content you have: add server subscriptions from Home using Add Server → Type → Subscribe; use Subscribe on the Config page for remote configuration files; and enter individual server details manually or import them from a QR code or the clipboard. This guide assumes you already have a provider and subscription. Follow the steps to enter, save, update, and test the connection—an import completing successfully does not guarantee the connection works.

1. Identify the link: a server subscription is not a configuration file

Before importing, identify whether you have a subscription URL, a link for a single server, or a configuration file URL. All three may look like text, but they are saved in different places and update differently. A URL starting with https:// does not tell you whether it belongs in Home or Config. Check the intended use and returned content based on the information provided with the link.

Content type	How to identify it	Where to import
Server subscription	Returns a list of server details remotely, often with access credentials	Home → Add Server → Type → Subscribe
Single server link	Common prefixes include `ss://`, `vmess://`, `vless://`, and `trojan://`	QR code or clipboard import on Home
Remote configuration file	Contains configuration sections, rules, and related settings—not just a server list	Config → “+” in the top-right → Download Configuration, then manage Subscribe
Individual connection details	Provides the protocol, address, port, and authentication details separately	Home → Add Server → the corresponding Type

This guide uses https://example.com/sub?token=xxxx as an obviously invalid subscription example to illustrate the format. It cannot be used to connect. Tokens in real URLs are often access credentials. Do not share complete links in public screenshots, comments, or diagnostic logs. QR codes may contain the same credentials and should be protected in the same way.

4 ways

Methods covered: Subscribe, manual entry, QR code, and clipboard

2 types

Remote content to distinguish: server subscriptions and configuration files

443

A commonly used HTTPS port; servers are not required to use it

2. Subscribe: save server subscriptions and Config files separately

To add a server subscription, start from Home—not Config. Importing a subscription creates an updateable source of servers. When its remote content changes, update it again to refresh the list on Home. Before you begin, note your existing groups and current selection so you can spot duplicate sources.

Open the add screen

Go to Home and tap “+” in the top-right to open Add Server. Make sure the link is identified as a server subscription before choosing a type.
Select Subscribe

Under Type, select Subscribe and paste your complete subscription URL into URL. Keep any parameters after the question mark, and do not include explanatory text.
Name and save

Enter a descriptive Remarks value. Check that there are no spaces or line breaks at either end of the URL, then tap Done. The name is for identification only; it does not change the remote subscription.
Update and verify

Return to Home and pull down to update. Check that server entries appear under the subscription, then verify that one entry’s Type, Address, and Port match the information you already have.

Using Subscribe on the Config page

If you have a remote configuration file URL intended for Shadowrocket, open Config, tap “+” in the top-right, enter the URL, and download the file. Review its contents before deciding whether to enable it. Use Subscribe in the file’s action menu to manage its remote updates. This subscription is for a configuration file, not a server subscription on Home.

3. Add Server manual entry: check each protocol’s connection details

Manual entry is for when you have individual connection details. Go to Home → “+” → Add Server, choose the actual protocol under Type, then fill in each field. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different authentication and transport fields. Do not put details into a similarly named field just to get the form to save.

Address and Port: Enter the host address and port provided for the service. Address should generally contain only a domain name or IP address—not https://, a path, or a subscription token. Do not change Port to 443 just because TLS is enabled.
Shadowsocks: Check that Method and Password match the server settings. An incorrect password or encryption method can make the connection unavailable.
VMess / VLESS: Check the UUID, transport method, and any Host, Path, and TLS settings specifically required for the service. Host, SNI, and Address may serve different purposes; do not assume they are interchangeable.
Trojan / Hysteria2: Check the authentication details and TLS-related settings. If the service specifies an SNI, enter it exactly as provided. Do not turn off certificate verification as a substitute for checking the settings.
WireGuard: Check the keys, interface addresses, Peer, Endpoint, and other fields against the configuration. Do not use a standard subscription URL as a key or Endpoint.

Tap Done to save, then return to Home and select the entry. Manually entered records are generally not updateable subscription sources. If the service changes its password, port, or transport settings, update the record as well. Matching names do not mean a manual entry and a subscription entry share an update relationship.

4. QR code and clipboard: parse first, then confirm what was saved

QR codes and the clipboard are input methods, not protocols. They may contain a link for a single server or a subscription URL. After importing, confirm which type of item was saved. A successful QR code scan only means the content was read; it does not confirm server authentication.

Choose how to import based on where the content is

QR code on another screen

On Home, tap the QR code scanner icon. The first time, allow camera access when prompted by the system.
Scan the entire QR code. Avoid glare, cropping, and excessive zoom.
After it is recognized, check the protocol type and address, then confirm the save.
If it is a regular webpage URL, confirm its purpose first. Do not treat a webpage as a server entry.

Link already on this device

Copy only the complete link, without any surrounding explanatory text or quotation marks.
Return to Shadowrocket. If prompted to import from the clipboard, review the content before confirming.
If the system asks whether to allow pasting, grant permission for this import as needed.
If no import prompt appears, go to Add Server → Type → Subscribe and paste the subscription URL manually.

In short: QR codes and the clipboard only transfer the original content. After saving, return to Home and verify the entry. Importing the same content repeatedly may create duplicates.

For links such as ss://, the encoded portion usually contains required parameters; do not copy only the readable name at the end. Do not change one protocol’s prefix to another—the prefix alone cannot convert authentication or transport settings. If recognition fails, copy the complete content again from its original source instead of experimenting with the encoded text.

5. Verify the import: check the server before choosing Global Routing

After saving an entry, select a server on Home and run Connectivity Test. A response only confirms reachability under the test conditions; it does not prove that all websites, UDP traffic, or DNS queries will work. The first time you turn on the connection, follow the system prompt to add a VPN configuration. Then test the same website again to avoid confusing results by switching test targets.

Config

Recommended

Use the rules and policies in the currently enabled configuration. A rule may route to DIRECT, a proxy policy, or another defined policy; traffic that does not match a rule does not necessarily go direct. Check FINAL to see the fallback behavior.

Best for: everyday routing based on your destinations with a verified configuration

Proxy

Temporarily testing with proxy routing can help distinguish server connection issues from configuration rule issues. Restore the previous mode when testing is complete, then continue checking DNS and access to the destination.

Best for: temporarily ruling out rule-related issues when a server is selected

Direct

Use direct routing to check access over the local network. If a website opens under Direct, that does not prove the imported proxy server works, because the test did not use the same proxy route.

Best for: checking basic connectivity over local Wi-Fi or cellular data

Scene in Global Routing applies routing behavior based on configured scenes; it is neither an import protocol nor a subscription format. When troubleshooting for the first time, avoid changing Scene, DNS, and server settings at the same time. If Settings → On Demand is configured, account for automatic connection behavior during testing. If you need to pause it, note the original setting and restore it afterward.

Rule order to check in Config

[Rule]
DOMAIN-SUFFIX,example.com,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

This example explains syntax only; do not use it to replace an existing configuration. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP address ranges, GEOIP matches IP locations, and FINAL provides the fallback policy. Rules are evaluated in order. PROXY in the example must resolve to a valid policy in the actual configuration. Importing a server list does not ensure that these rules and policy references are correct.

6. Subscription updates and common import issues

The subscription URL, subscription content, and server connection are three separate things to check. If an update fails, first confirm the URL is still valid and that the network can reach the subscription endpoint. If the update succeeds but the connection fails, check the selected server and routing configuration. Avoid deleting all records repeatedly while troubleshooting, or you will lose a useful baseline for comparison.

Subscription update timed out. What should I check first?

First, check that you can access websites over your local network, then update the subscription again from Home. If the subscription URL requires a proxy and you already have a working connection, check Update via Proxy under Settings → Subscribe and try again. Enabling this option alone cannot establish a working proxy route if all servers are unavailable.

The update completed, but why are there no servers?

Return to the subscription editor and check that the URL was copied in full, especially the parameters after ?. Make sure the response is not a login page, error page, or configuration file. If the URL points to a configuration file, follow the Config workflow instead of repeatedly adding it as a server subscription.

Pasted a link, but no import prompt appeared. Why?

Copy the plain-text link again from its original source. Make sure it has no quotation marks or spaces and has not been truncated by a messaging app. Paste a subscription URL directly into Home → Add Server → Type → Subscribe. For a single server link, check that the prefix and encoded portion are complete, and confirm that the system allows pasting.

Why did my manual changes revert after an update?

A subscription uses remote content as its update source, so the next update may overwrite parameters. Save independent test entries as separate manual records with clear names if you need to keep them long-term. Do not rely on temporary edits to a remote subscription as a stable configuration.

The import completed and the switch is on, but why can’t I connect?

First, check the selected server on Home and run Connectivity Test. Then review Global Routing, use Proxy for a temporary comparison, and finally check DNS, policy references, and FINAL in Config. Change one setting at a time and note what happens before and after.

7. A quick checklist before and after saving

After importing, you should be able to identify where the content came from, which page it was saved on, how to update it, and which entry the connection uses. Keeping track of these four things is more reliable than relying on the name alone. For service terms, connection limits, or authentication changes, check the information for the service you already use. This guide covers configuration steps only.

Before importing: Identify whether the content is a server subscription, remote configuration file, or individual connection details. Keep your current working configuration.
After saving: Check Type, Address, and Port on Home. In Config, confirm whether the downloaded file has actually been enabled.
After updating: Check that the source updated without errors, and see whether changes to the remote list mean you need to reselect an entry.
After connecting: Check Global Routing, test against the same destination, and record subscription update issues separately from server access issues.
When sharing diagnostic details: Hide tokens, passwords, UUIDs, keys, and QR codes. Include only the field names and symptoms needed for troubleshooting.