Four Ways to Import a Shadowrocket Subscription: Subscribe URL, Add Server, QR Code, and Clipboard

At a glance

If you have a subscription URL, use Subscribe. Use Add Server for a single server’s details. QR codes and the clipboard are just ways to read and import data; they don’t guarantee that the result will be a subscription. This guide focuses on Home and Config on iPhone and iPad, covering how to identify, save, update, and verify imported data. Mac (Apple silicon and Intel), Windows, Android, and Linux users can follow the same field-checking principles; button locations vary by platform.

First, tell subscriptions, individual servers, and configuration files apart

The right import option in Shadowrocket depends on the data you have, not on how long a URL looks. Get subscriptions from your provider; they’re usually HTTPS URLs that return a list of servers. A server share link describes one connection, while a configuration file controls settings such as rules, DNS, and policies. Putting all three into the same field is a common reason for an import to appear successful while no servers show up in the list.

Use Home to view and select servers and control the connection. Config manages configuration files and related Subscribe actions, while Settings manages app preferences. You can also add Subscribe as a Type under Add Server on Home. Check the screen title and Type before proceeding; don’t enter a remote configuration file URL as a server subscription.

What you have	How to identify it	What to do
Server subscription URL	Labeled as a subscription by your provider; returns a list of servers when retrieved	Add and update it with Subscribe
Single-server share link	Common prefixes include `ss://`, `vmess://`, `vless://`, and `trojan://`	Import from the clipboard or scan a QR code, then check the Type after saving
Server details	Lists the address, port, credentials, and transport settings separately	Enter it manually with Add Server
Rule configuration file	Contains sections such as `[General]` and `[Rule]`	Manage it in Config; don’t enter it as an individual server

HTTPS only means the URL uses encrypted transport; it doesn’t prove that the URL is a subscription. Your provider’s dashboard login, help pages, and subscription URLs may all start with HTTPS. Copy the URL explicitly labeled as a subscription, not the address of the page currently open in your browser.

Method 1: Add with Subscribe and keep the update source

Subscribe is best when you need to sync a server list regularly. It keeps the original subscription URL so you can fetch the list again later. Servers entered one by one won’t automatically reflect additions or changes made by your provider. Before you start, note the existing groups and selected server on Home so you don’t mistake existing entries for newly imported ones.

Copy the URL

Get the subscription URL from your provider and use the page’s copy button. Check that there are no spaces, line breaks, or punctuation added at the beginning or end. Don’t omit query parameters after the question mark.
Open the import option

When using Subscribe in Config, first confirm which subscription it will act on. To add a server subscription to Home, go to Home → + in the top-right corner → Add Server → Type → Subscribe.
Enter the URL

Paste the complete subscription URL into the URL field and add a note that will help you identify it. Don’t split a token from the URL and enter it as the Password, or paste the entire HTTPS URL into a regular server’s Address field.
Save and update

After saving, return to Home and check for the subscription group and its server entries. To fetch the list again, pull down to refresh on Home and check the update result rather than just confirming the URL is still in the field.
Select and test

Select a server in the new group, then run Connectivity Test. Servers appearing in the list means the subscription was parsed; a successful test additionally indicates that the selected server responds on your current network.

If your subscription URL has been exposed, reset or replace its credentials with your provider, then update the saved URL in Shadowrocket and refresh the subscription. Deleting the local list alone won’t invalidate the old URL.

Method 2: Enter a single server manually with Add Server

Manual entry is useful when you only have a server details sheet, need to check one connection, or want to create a temporary standalone test entry. Go to Home → + in the top-right corner → Add Server, select the Type, then fill in the corresponding fields. Type determines how credentials and transport settings are interpreted; don’t change it just to get the entry to save.

The two cards below illustrate how to check fields; they are not connectable servers. Port 443 is used as an example, not a fixed port for every protocol. Use the values provided by your provider for each field.

Shadowsocks field example

Type: Shadowsocks
Address: ss.example.com (example domain)
Port: 443 (example port)
Method: aes-128-gcm (format example only)
Password: demo-only-not-valid (invalid example)

Method and Password must match the server configuration; don’t infer them from the protocol name alone.

Trojan field example

Type: Trojan
Address: trojan.example.com (example domain)
Port: 443 (example port)
Password: demo-only-not-valid (invalid example)
SNI: tls.example.com (example name)

SNI is used for the TLS handshake. Whether to enter it separately, and what value to use, depends on your provider’s settings.

VMess and VLESS often require a UUID and may also use transport settings such as WebSocket. The WebSocket Host and Path are different from the server Address; preserve the slashes and capitalization in Path. Hysteria2 and WireGuard have their own authentication or key fields, so don’t use the Shadowsocks Method and Password combination for them.

Enter only the required hostname or IP address in the address field; don’t add https:// yourself.
Enter the port provided by your provider; don’t switch to 443 just because TLS is enabled.
If the UUID, key, SNI, or transport settings are missing, check your provider’s information before proceeding. Don’t guess.
After saving, check the note and Type, then select the entry and test it. Editing a standalone entry won’t change the subscription source.

Method 3: Import by QR code and check its contents first

QR scanning is useful when your provider displays the details on another device and you scan them with the device you’re using. A QR code just carries text: it might contain a single-server link, a subscription URL, or simply a website login address. Recognizing the code doesn’t mean the server has been added.

Display the QR code provided by your provider on another screen. Make sure the entire code is visible and its edges aren’t cropped when zoomed in.
Open the scanner from the top-left corner of Home and allow camera access when prompted. If you denied permission, change it in Shadowrocket’s permissions page in system settings.
Check the content after scanning. If Add Server opens, review Type, Address, and Port. If a subscription URL is detected, make sure to save it with Subscribe.
After saving, return to Home and check whether you added a standalone entry or a subscription group, then select the entry and test it.

Don’t share the original QR image publicly to troubleshoot scanning. It may contain a password, UUID, or subscription token; covering nearby text doesn’t hide credentials embedded in the code itself.

Method 4: Import from the clipboard and keep the complete URL

The clipboard is handy when switching between a browser, your provider’s page, and Shadowrocket on the same device. Copy the original share link, return to Home, and use the clipboard import option—or confirm the import prompt when the app detects clipboard content. If the system asks whether to allow pasting, allow it for this import you initiated.

4 methods

Import methods covered: Subscribe, Add Server, QR code, and clipboard

443

The manual-entry port is an example, not a universal default

2 types

Key import results to check: standalone servers and subscriptions that can be updated

Don’t copy instructions, quotation marks, or code fences along with the URL. Some links appear on multiple lines in a chat window even though the original text is one line; selecting the lines manually can omit characters. Use your provider’s copy button where available, preserve encoded characters, and don’t replace values such as %2F with other characters.

ss://, vmess://, vless://, and trojan:// are commonly used to share individual servers; whether a link can be parsed depends on its complete format.
You can paste a standard HTTPS subscription URL directly into the URL field under Subscribe. If it isn’t detected automatically, there’s no need to keep switching between apps.
If you copied multiple links, check the number of entries and their Types after importing. When troubleshooting for the first time, start with a single link.
After importing, copy a line of ordinary text to replace the clipboard contents and reduce the chance of accidentally pasting credentials elsewhere.

Check updates, connections, and Global Routing after import

Importing, updating, connecting, and routing traffic are separate steps. Retrieving a subscription list doesn’t mean every server in it is reachable. A response from Connectivity Test also doesn’t mean all websites will follow the intended routing policy. When troubleshooting, keep the same server and test address, and change only one setting at a time.

Check the server list: On Home, confirm that servers appear under the subscription group and select the entry you want to test. If you only saved the subscription URL and no servers appear, check the update result first.
Check the connection: Run Connectivity Test, then turn on the connection switch on Home. The first time you connect on iPhone or iPad, follow the system prompt to allow adding a VPN configuration.
Check routing: Go to Home → Global Routing. Proxy sends traffic through the proxy; Direct connects without a proxy; Config follows the active configuration rules; Scene follows the configured scene. Scene isn’t a fixed global proxy mode.
Check the rules: When using Config, confirm that the active configuration and its policy references are valid. Rules are matched in order, and updating a server subscription won’t fix an incorrect policy name.
Enable automatic connections last: Once manual testing is stable, consider Settings → On Demand. On Demand controls when to connect; it doesn’t download subscriptions or replace checks that the servers are valid.

For example, DOMAIN-SUFFIX,example.com,DIRECT routes matching domains and their subdomains through DIRECT; IP-CIDR,192.0.2.0/24,DIRECT is an example rule for an IP range. GEOIP matches by IP geolocation, while FINAL is the fallback. Even with a server selected, requests matching DIRECT won’t go through that server. That’s a rule outcome, not necessarily an import failure.

Subscription updates and import troubleshooting

No new servers appeared after pasting. Is the link wrong?

First check whether the original data is a subscription or a single-server share link. Enter an HTTPS subscription URL in the URL field under Home → + → Type → Subscribe, save it, then update. A login page URL isn’t a subscription. If the update returns webpage content, get the subscription URL from your provider again.

A subscription update timed out. Should I delete and reinstall the app?

First, check that your current network can reach the subscription URL and that the URL is complete. If you already have a working server, connect to it, then check Update via Proxy under Settings → Subscribe. Enable it if needed, then return to Home and refresh. This requires an existing working proxy and won’t help with a first import when no connection is available.

What should I do if an update returns 401 or 403?

These status codes usually mean the subscription server rejected the request. Check whether the token was truncated or reset and whether your account still has the required access. Confirm with your provider before replacing the URL. Don’t give the full subscription URL to strangers for troubleshooting; share only the error details with credentials removed.

Why did my manual edits change after an update?

Subscription updates sync the content returned by the server, so local edits to entries in the subscription may be overwritten. To keep test settings, create a separate standalone entry with a clear note, then compare it with the updated subscription. Don’t assume that the standalone entry means the subscription updated successfully.

I’m connected, but webpages still won’t load. What should I check?

First, confirm the selected server on Home and run Connectivity Test. Then check whether Global Routing is set to Direct or whether Config rules are sending requests to another policy. Note the exact timeout, DNS, or certificate error, and check the network, DNS resolution, and TLS settings separately. Don’t change every field at once.

Keeping a working standalone test entry before updating helps distinguish an unreachable subscription URL from an unreachable server. If only one entry fails, compare it with other entries in the same subscription. If the entire subscription can’t be retrieved, check the URL, access permissions, and network used for the update before changing server ports one by one.