What is a subscription link? A complete beginner’s guide to getting, importing, and updating one

What is a subscription link? In simple terms, it is the entry point clients use to retrieve server configurations. Instead of entering server addresses, ports, protocols, and credentials one by one, users can import the link into a compatible client to retrieve the current node list. When the service updates its routes, refreshing the subscription lets the client load the new configuration.

It is not a network protocol or the connection button itself. A subscription link delivers configuration; protocols such as Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC describe or establish the connection; and the client parses the configuration, selects nodes, applies routing rules, and handles system traffic. Keeping these three layers separate makes import failures and ineffective updates much easier to diagnose.

What a subscription link actually contains

After a client accesses a subscription link, it usually receives a machine-readable configuration. The response may be an encoded collection of nodes, YAML, JSON, or a client-specific format. Common fields include node names, server addresses, connection ports, protocol types, authentication data, transport parameters, and grouping tags. The exact format depends on server-side and client compatibility, so the link extension alone is not enough to identify it.

A single subscription can include different routes. Node names may indicate a region, entry type, or purpose, while the protocol fields define the actual connection method. IEPL dedicated lines, relay routes, and direct routes describe network paths; they are not the same as connection protocols such as Shadowsocks, Trojan, or VLESS. The former answers “Which path does the traffic take?” while the latter answers “How does the client communicate with the entry point?”

The returned subscription content is not necessarily readable directly in a browser. Seeing a long string of characters does not mean the link is broken; seeing a download does not mean you must open the file manually. The correct approach is to give the link to a compatible client for parsing. Conversely, if the client clearly says the format is unsupported, check whether you selected the wrong client type or whether the dashboard offers a subscription entry for the required format.

Get and securely store it in the user dashboard

To obtain the link, sign in to the service dashboard and open the account overview, route management, or subscription section. Names vary, but look for an entry such as “Copy subscription,” “Import to client,” or a client name. If the dashboard offers both a universal subscription and client-specific subscriptions, choose the format that clearly matches your current app instead of importing every link.

1. Open the dashboard on a trusted device and confirm that you are signed in to your own account.
2. Find the subscription or route section and read the supported clients and format shown beside the link.
3. Use the copy button to capture the complete link and avoid missing characters during manual selection.
4. Switch to the client and complete the import right away; do not leave the link in chat history or public notes.
5. After importing, check the subscription name, node list, and update time before testing the connection.

• ✅ Copy the link from the service’s official dashboard.
• ✅ Choose the subscription format that matches the client.
• ✅ Store the link as an account credential and share it only between controlled devices.
• ✅ Before taking troubleshooting screenshots, hide the complete link, authentication strings, and QR code.
• ❌ Do not paste the link into online conversion pages from unknown sources.
• ❌ Do not share a subscription address with others or publish node configurations.

A QR code is simply another way to display subscription information; it does not make that information less sensitive. Anyone who can clearly see the code may try to read its contents. Scan it only between your own devices, and keep QR codes out of troubleshooting screenshots. Browser history, clipboard syncing, and cloud notes can also expand where the link is stored, so remove unnecessary copies after use.

How to import into clients on each platform

Button locations differ across platforms, but the workflow is much the same: create a subscription profile, paste the link, name the subscription, save and update it, then choose a route from the node group. Do not paste a subscription link into the server-address field for “Add a single node manually”; that field usually accepts only a hostname or network address and cannot parse an entire subscription.

Desktop systems: confirm the traffic-handling mode first

Windows and macOS clients commonly offer system proxy, virtual network adapter, or rule modes. After importing a subscription, nodes appearing in the list does not mean every app is covered. With system proxy enabled, software that ignores system proxy settings may still connect directly. Virtual network adapter mode covers more traffic, but requires the relevant system permissions and is more likely to conflict with other network tools, virtualization software, or enterprise network policies.

For troubleshooting, first close tools that also take control of network traffic and leave only one client running. If a browser works but a desktop app does not, check whether the app has its own proxy settings, uses a fixed DNS resolver, or is being classified as direct by the current routing rules.

Mobile systems: permissions and background policies matter more

After importing on Android, you will usually need to approve the system VPN permission. Some clients support per-app proxying, allowing selected apps to use a route while others connect directly. If battery-saving restrictions are enabled, the client may be paused in the background, causing the connection to drop after the screen locks or the status-bar indicator to disappear. Allow the client to maintain the necessary background activity in system settings, but do not grant unrelated permissions.

iOS and iPadOS clients rely on the network-extension capabilities provided by the system. The first activation requests permission to add a VPN configuration; subscription updates are generally handled inside the client. A connected status-bar indicator only shows that the network extension is running; it does not by itself prove that requests are being routed as intended. Check the client logs, current policy group, and actual resolution results together.

Routers: verify format and resources first

Routers are useful for handling a home network centrally, but before importing, confirm that the firmware plugin can parse the protocols in the subscription. Older cores may not recognize Hysteria2, TUIC, or newer VLESS transport parameters, causing some nodes to disappear or the service to fail after an update. In that situation, update the compatible core or use a compatible format provided by the dashboard; do not delete fields you do not understand.

How often should you update a subscription?

There is no fixed refresh interval that applies to every service and client. Updates synchronize the current server-side configuration; they are not intended to increase connection speed. Manually update when the dashboard reports route changes, node names change, existing nodes remain unavailable, the client has not been opened for a long time, or the service requires a configuration refresh.

If the client supports automatic updates, enable them according to your usage, but do not treat an update as a real-time speed test. Each update normally downloads the configuration again; only an actual connection can show whether a node suits the current network. Refreshing more often will not fix local DNS issues, system proxy conflicts, an outdated protocol core, or an unreachable network.

1. Find the current subscription group in the client and run an update or refresh.
2. Wait for the configuration to finish parsing and watch for any clear error message.
3. Check whether the number and names of nodes changed reasonably; do not rely only on a “Success” message.
4. Select the target node or policy group again, and disconnect and reconnect if necessary.
5. Test web access, DNS resolution, and the apps you need instead of checking only the connection icon.

Some clients keep the old configuration currently in use after updating until you reconnect; others reload it immediately. If the list has changed but connection behavior has not, disconnect and reconnect before considering a client restart. Deleting the entire subscription should be a last resort because it also removes local groups, policy selections, and custom overrides.

Why check routing rules and DNS together?

A subscription provides nodes, but that does not mean every client automatically uses the same rules. Rule mode typically decides whether requests use the proxy or connect directly based on domains, network addresses, apps, or rule sets; global mode generally sends more traffic through the current node; direct mode bypasses the node. If the mode is wrong, the target site may still be reached through the local network even when the node is connected.

DNS leaks commonly occur when the connection uses a proxy but domain resolution still uses the local resolver. The concern is not limited to privacy: inconsistent resolution and exit regions can lead to the wrong site version, indirect routes, or unreachable domains. If the client supports remote DNS, proxy DNS, or virtual DNS, understand how each option relates to the current mode and avoid stacking multiple system-level DNS tools.

• ✅ Before connecting, confirm whether the current mode is rules, global, or direct.
• ✅ Check that the target domain matches the expected rule and policy group.
• ✅ Confirm that browser Secure DNS, system DNS, and client DNS are not overriding one another.
• ✅ Recheck resolution and the exit path after switching nodes; do not rely on old cached results.
• ❌ Do not attribute every access problem to a failed node.
• ❌ Do not run multiple clients that modify the system proxy or routing table at the same time.

If an app never uses the proxy, first check whether it uses an independent network stack or a built-in proxy. On Android, per-app proxy settings also require checking whether the app is in the include list or exclude list. On desktop, verify that the system proxy is actually enabled and that the app does not ignore it. Virtual network adapter mode usually covers more apps, but firewalls, enterprise policies, and local route priorities can still affect it.

What to do after a link is exposed

If a subscription link was posted in a public group, forum, or public area of a support-ticket screenshot, or submitted to a tool whose data handling you cannot verify, do not simply delete the message and continue using the old link. It may already have been cached, forwarded, or read. Invalidate the old link, then import a new one into your own clients.

1. Open the dashboard and look for an option to reset the subscription, refresh its token, or generate a new link.
2. Run the reset and confirm that the old subscription can no longer retrieve the configuration.
3. Delete the old subscription address from all your clients so automatic updates do not continue requesting the old entry point.
4. Copy the new link and import it again, then restore your previous node selections and routing settings.
5. Check where the link was saved and remove public screenshots, shared documents, and unnecessary synced copies.

Resetting a subscription usually changes the credentials used to access its configuration; it is not the same as changing the account password. If the exposure also included login credentials, handle account security separately. Conversely, changing the account password may not automatically invalidate an old subscription link, so rely on the reset result shown in the dashboard. If you cannot find a reset option, contact official support and explain that the “subscription address may have been exposed,” asking them to invalidate the old address.

How to quickly diagnose an import failure

Start troubleshooting by asking whether the link can be read, then whether its contents can be parsed, and finally whether the nodes can connect. Each stage has different symptoms. Mixing them together often leads to repeatedly reinstalling clients or switching nodes without finding the cause.

When reviewing logs, identify whether download, authentication, parsing, DNS, or connection-timeout errors belong to the same stage. Logs may contain server addresses or configuration fragments; handle sensitive content as required before sending them to support. Do not paste a complete subscription link into a public discussion for troubleshooting.

If the same subscription imports successfully in one client but fails in another, check format and protocol support first. If every device fails to read the same link, focus on the link status or server-side configuration. If connection fails only in one network environment and returns after switching networks, continue checking local DNS, routing, firewall settings, and network reachability.