Shadowrocket Subscription Import: Subscribe, Add Server, QR Code & Clipboard

In this guide

This guide is for users who already have their own provider details or subscription link and want to import them into Shadowrocket. First, distinguish a server subscription from a Config file, then choose Subscribe, Add Server, QR code, or clipboard based on what you have. Finally, check the imported entries, update results, and connection status. This site does not provide, sell, or recommend servers or subscriptions.

1. Subscribe vs. Config files

These are four import methods, not four protocols. Subscribe saves a subscription source and retrieves server entries. Add Server lets you create a server manually or add a subscription by setting Type to Subscribe. QR codes and the clipboard are just ways to read data; whether they create a single server or a subscription depends on the original content.

Home is mainly for selecting a server and controlling the connection. Config is for managing configuration files, and Settings is for adjusting app behavior. When checking Subscribe-related items on the Config page, don't confuse a remote configuration URL with a server subscription URL. The former may contain rules, DNS settings, and policy references; the latter is usually used to update the server list. Even if both are HTTPS URLs, they aren't interchangeable based on appearance alone.

Choose an import method based on what you have

Servers and subscriptions

Full subscription URL: Home → + → Type → Subscribe.
Separate fields such as address, port, and password: Home → +, then select the matching Type.
Single share link or QR code: scan or import it, then verify the protocol and server fields.

Config files

Check that the supplied details refer to a configuration file, not a server list.
Manage, view, and select the configuration you want to use in Config.
Check that the policies referenced by the rules match existing servers or policy groups.

Check what the supplied data is for before importing. A successful Config import does not mean a server subscription was updated.

2. Subscribe: Save the source and update the server list

If you have a full subscription link, keep it as a Subscribe entry instead of copying only one server from the latest list. The subscription entry stores the source URL so you can retrieve the list again later. A manually added server won't automatically sync when the original subscription changes. Subscription contents and validity depend on the service you already use; purchasing the app does not provide these details.

Verify the source

Copy the full subscription URL from your own service account. Make sure it's a subscription link—not a login page URL or a share link for a single server.
Select the type

Go to Home → + in the upper-right corner to open Add Server, then set Type to Subscribe. Don't enter a subscription URL in the server address field for Trojan or Shadowsocks.
Enter the URL

Paste the URL into the URL field and enter a name you can recognize. Check the protocol at the start, parameters at the end, and that no characters are missing, then save.
Refresh and verify

Return to Home and pull down to refresh the subscription. Check whether server entries appear. Expand the relevant group and verify the names, protocols, and number of entries against the source details. If an error appears, note the exact message first.

The examples below show link formats only; they are not usable subscriptions. A token in an actual URL may identify account permissions, so treat it as sensitive information. Don't post the full link in public comments, screenshots, or support reports. You can hide parameter values while troubleshooting, but don't alter the original URL in use.

https://example.com/sub?token=xxxx

3. Add Server: Enter settings for each protocol

Use Add Server to enter details manually when you have a server address, port, and authentication fields. Select Type first, then enter each field using the details provided by your service. Fields differ by protocol, so don't mix up the password, UUID, encryption method, or transport settings. Check Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard against their respective details; don't fill in unknown settings based on defaults.

Check Shadowsocks fields

Type: Shadowsocks
Address: Enter the server hostname or IP address from your existing details.
Port: Enter the listening port specified by the server.
Method: Use the same encryption method as the server.
Password: Preserve capitalization and special characters exactly.

Don't enter a subscription URL in the address field. Method and Password must go in their respective fields.

Check Trojan fields

Type: Trojan
Address / Port: Use the destination address and port specified in your details.
Password: Enter the authentication password, not the token from a subscription URL.
SNI: Enter the TLS server name required by the server.
Allow Insecure: Keep certificate verification enabled; don't bypass it to hide certificate errors.

The connection address and SNI serve different purposes. The certificate name must match the actual TLS configuration.

For example, enter 443 only if your details explicitly specify Port 443; TLS does not mean every service uses this port. After saving, reopen the entry and check that each value is in the correct field. If your provider later changes the password or port, update the manual entry yourself. Refreshing a separate Subscribe entry won't update it.

4. QR codes and clipboard: Check the content before importing

Scanning works well for QR codes displayed on another screen; the clipboard is convenient for copying a full link on the same device. Neither method guarantees that the content is a server, subscription, or valid configuration. A QR code may encode a webpage URL, and the clipboard may contain explanatory text along with a link. Check what the source is for before deciding whether to save it.

QR code: Open the scanner from Home and allow camera access when prompted. Position the entire QR code in the viewfinder. After scanning, verify the content type. If it only opens a webpage, don't treat the webpage URL as server details.
Clipboard: Copy a single complete share link, return to Shadowrocket, and follow the import prompt. If the system asks for permission to paste, allow it for this action. If no prompt appears, paste the link manually in the appropriate Add Server field. Don't repeatedly copy an entire page of instructions.
Single server: Prefixes such as ss://, vmess://, vless://, and trojan:// identify share-link formats. Don't rewrite the prefixes or mistake them for HTTPS subscription URLs.
Subscription URL: For an HTTPS link, first verify what the source is for. Even if you got it via QR code or clipboard, make sure it's saved as Subscribe and successfully retrieves the server list.

If the QR code is in a photo on your device, use the photo import option in the scanner if available. If you don't see that option, use the text link provided by the source instead. Don't recreate or publicly share a QR code containing a password just to scan it. Importing the same details more than once using different methods may create duplicate entries. Check names and sources before testing.

5. Check three layers after importing—not just the connection switch

Saved, subscription refreshed, and VPN connected are different states. Saving means the app accepted the input. A successful subscription refresh means the source was retrieved and parsed. Even with the connection switch on, individual requests still depend on server status, Global Routing, and the active Config. Check each layer in order to avoid blaming every issue on the import method.

Layer 1

Details: URL, protocol, address, and authentication fields

Layer 2

List: subscription update results and currently selected server

Layer 3

Requests: VPN permission, Global Routing, and Config

In Home, confirm that the newly imported server is selected, not an older entry. Run Connectivity Test and note the result. A successful test does not guarantee that every website or service will work.
When you connect for the first time, grant the system permission to configure the VPN. If you denied permission, resolve that first before checking whether the server is available.
Check Global Routing: Proxy, Direct, Config, and Scene each work differently. Selecting a server does not make Direct route traffic through it. Config handles requests according to the active configuration, and with Scene you also need to check which scene is selected.
When using Config, check the active file on the Config page and review its rules and policy references. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP ranges, GEOIP matches against an IP geolocation database, and FINAL handles requests that don't match any preceding rule.

6. Subscription updates and common import issues

Updating a subscription retrieves the source again. It does not repurchase the app or update every rule in Config. Before refreshing, keep the existing entry and note any error message. Change one thing at a time: check the URL first, then the network path, and finally the service permissions. Don't delete configurations, change DNS, and rebuild servers all at once.

Why is the list still empty after I paste the URL?

Open the relevant Subscribe entry on Home and check its Type and URL, then return to Home and pull down to refresh. If the URL actually returns a login page, empty content, or an unsupported format, saving it won't create server entries. Ask your service provider whether the URL is intended for importing subscriptions into Shadowrocket.

A subscription update timed out. What should I check first?

First, check whether your current network can reach the subscription source. If you already have a working server, connect to it and try again. If you need to retrieve the subscription through a proxy, check Settings → Subscribe → Update via Proxy. Enabling this option alone won't help if you have no working connection to reach the source.

I got a 401 or 403 error. Did I choose the wrong import method?

These HTTP responses usually indicate an authentication issue or access restriction. Copy the full URL again from your own account page, check that the token isn't truncated and the link hasn't expired, and verify the service status. Switching between QR code and clipboard won't help; reading the same URL another way won't change the server's authorization result.

What should I do if a server's name disappears after an update?

The subscription source may have changed its list or server names. Expand the subscription group to view the latest entries, select a currently available server, then check whether Config has policies referencing the old name. Check manual and subscription entries separately to avoid deleting details you still need.

When reporting an issue, include the import method, Type, steps that triggered the error, and the error text with sensitive information removed. Don't share a full subscription URL, password, UUID, WireGuard private key, or QR code containing any of these details. If sensitive credentials have been exposed, reset them through your service account rather than only deleting the entry from your device.