A VPN subscription link is an address that points to a configuration list — it is not a node itself. The client visits that address at a fixed interval, pulls the node list, protocol parameters and routing rules the server sends down, and builds its connections from them. The problems beginners hit most — “import succeeded but the list is empty”, “it says connected but pages won't open”, “update failed” — usually come from the getting, importing or updating stage. The four steps below cover each in turn.
What's Actually Inside a Subscription Link
Think of a subscription link as a configuration index. When the client requests it, what comes back is a config file containing at least four kinds of information: node addresses and ports, protocol type and encryption parameters, identity credentials (a UUID or password), and TLS-related fields (SNI, camouflage domain). If the config also carries routing rules and node groups, the client will send different traffic through different exits — video through one route, work domains through another, for example.
The difference from a single-node link is granularity. A single-node link is one URI — ss://, vmess://, trojan://, vless://, hysteria2://, tuic:// — and copying one gets you exactly one node. A subscription link is a set of nodes with built-in updating: when the server changes routes, the client only has to pull once to stay in sync, with no adding one by one by hand.
How the Common Protocols Compare
| Protocol | Transport and handshake | Typical use case |
|---|---|---|
| Shadowsocks | Lightweight, simple handshake, encryption handled by the protocol itself | Everyday browsing, video and other general use |
| VMess | Carries a user ID and time check, with more options to configure | Broad compatibility, supported by older clients |
| VLESS | No encryption of its own; security depends on the transport layer (such as TLS) | Where lower handshake overhead matters |
| Trojan | Runs over standard TLS; traffic looks close to HTTPS | Networks that inspect traffic patterns closely |
| Hysteria2 | Built on QUIC / UDP with congestion control included | Weak networks, high packet loss, long-distance routes |
| TUIC | Also QUIC-based, with multiplexing and 0-RTT | Where first-packet latency matters |
The protocol is decided by the server; the client just opens a connection using the fields in the config. You don't need to pick a protocol by hand — whatever the subscription delivers is what the client uses. What actually shapes your experience is the route type and exit location, not the protocol name.
Where to Find the Subscription Link in Your Dashboard
The subscription link follows your account, and it isn't on any marketing page. Log in to the dashboard, open the download page, choose your platform, and the page gives you one or more subscription addresses plus matching QR codes. The whole flow is four steps:
- Log in to the dashboard with the username and password you registered with. No email address is required — a username and password is enough.
- Open the Download page and choose your: Windows, macOS, iOS, Android or Linux.
- Copy the subscription link shown on the page, or scan the QR code with your phone.
- Paste the address into your client, run one update, and confirm the node list appears.
The dashboard usually offers several addresses in different formats: a node list for general clients, and structured configs for clients that expect them (Clash YAML, sing-box JSON, for example). The classic symptom of picking the wrong one is “import succeeded but the list is empty” — switch to the address in the matching format.
A subscription link is as good as an account credential. Anyone who has it can pull your nodes and burn through your traffic quota, so treat it like a password: don't forward it to public groups, and mask the token segment at the end of the address completely when you take screenshots.
How to Import on the Five Platform Clients
There are really only three ways in: paste the subscription address, read it from the clipboard, or scan a QR code. What differs is mostly where the menu lives and which system permissions are needed.
Windows
Open the client's configuration or subscription page, paste the subscription link into the field, and click Download / Update. Once it finishes, pick a route from the node group. On Windows, some clients only accept a local config file — download the subscription address as a YAML file first, then import that file into the client.
macOS
The client usually lives in the menu bar. Find the subscription or configuration entry in its menu, add the address, then trigger one update manually. Some clients support one-click import via URL scheme: build the subscription address into the scheme link and open it in a browser to finish adding it.
iOS
Install the client from the App Store, add the address on the subscription page and update, then pick a node — the first connection asks you to allow the system to add a VPN configuration. iOS clients generally support reading from the clipboard when adding a subscription, and you can also paste the full address by hand.
Android
Most clients support both clipboard import and QR scanning. Two things to check afterwards: allow the client to establish a VPN connection in system settings, and turn off battery optimization for that client — otherwise the system may interrupt background subscription updates.
Linux
On desktop you can import the subscription with a GUI client; in a pure command-line setup, download the subscription address as a config file and let the command-line client read that local file. Command-line setups generally don't update automatically, so you'll need to re-download on a schedule.
The differences between clients come down to one thing: some accept only the plain node list, others only a structured config. When an import fails, check that the format matches before you suspect the address itself.
How Often Subscriptions Update, and When to Update Manually
Subscriptions are pull-based: the client requests the subscription address at a set interval and gets the latest config. Most clients update automatically once a day by default; you can change the interval to a few hours, or set it to update on every launch. Too short an interval achieves little beyond extra requests; too long and you may keep retrying nodes that have already been taken offline.
Update manually right away in these situations:
- Your plan or routes have changed and the dashboard says the configuration was updated;
- Nodes in one region fail to connect several times in a row while others work fine;
- You've switched devices or reinstalled the client and need the latest config locally;
- You reset the subscription link in the dashboard — the old address is dead and you must re-import with the new one.
If new nodes still don't show up after updating, first check whether the client cached the old config. Most clients keep the previous config as a fallback after an update; if the interface hasn't refreshed, quitting and reopening the client usually brings the new list up.
Subscription updates mostly happen silently and don't pop up an error when they fail. When a connection misbehaves, update manually once before blaming the node — it saves half of your pointless troubleshooting.
If Your Subscription Link Leaks, Do These Steps in Order
A leaked subscription link doesn't mean your account was stolen, but the risk is real: someone else can use your quota and take up your concurrent connections. Order matters more than speed — cut off access first, then work out what happened.
- ✅ Reset the subscription link in your dashboard immediately. The old address stops working right away, which cuts off the other party's access in one move.
- ✅ Re-import the new link on every device and update manually once to confirm the old config has been overwritten.
- ✅ If the password leaked along with the link, change the account password at the same time. If only the link leaked, changing the password isn't strictly necessary, but it's the safer move.
- ✅ Check the device and traffic records in the dashboard to confirm no unfamiliar device is using your quota.
- ✅ Trace how it leaked: did you post it in a group, paste it into a public thread, or leave the address unmasked in a screenshot?
Rule of thumb: if the subscription link has appeared anywhere you don't control — a public group, a forum, a third-party “subscription converter” site, an unmasked screenshot — treat it as leaked and reset it. The cost of resetting is one re-import; the cost of not resetting is traffic that keeps draining.
Three Common Mistakes
- ❌ Posting the subscription link in a public group “to test the speed”. You only need to run a speed test locally — posting the link hands over your credentials.
- ❌ Running a token-bearing link through a third-party “subscription converter”. The converter sees the full address, which means handing your credentials to a stranger's service.
- ❌ Deleting the chat message and calling it done. The message may already have been forwarded or screenshotted; the only reliable fix is to reset the subscription.
Import and Update Troubleshooting Table
Importing and updating are the two steps beginners get stuck on most. The table below lists common causes and fixes by symptom — work through it first, then decide whether you need to go back to the dashboard and reset the subscription.
| Symptom | Likely cause | Fix |
|---|---|---|
| Import succeeds but the node list is empty | The subscription format doesn't match the client — for example, a structured config pasted into a client that only reads the plain node list | Go back to the dashboard and copy a subscription address in the matching format |
| Update returns 401 / 403 | The subscription link was reset, or the token segment at the end was cut off when copying | Copy the full address again and make sure there are no extra spaces or line breaks |
| Shows connected but pages won't load | Routing rules send the target domain direct, or local DNS is still resolving through your ISP | Compare rule mode against global mode once, and check your DNS settings |
| Some apps aren't affected | The client's TUN mode is off, so only apps that read the system proxy are routed | Turn on TUN mode, or check whether that app reads the system proxy |
| A single node keeps timing out | That route is temporarily being adjusted, or the path from your local network to that entry point is unstable | Update the subscription once, then compare with another route in the same region |
Beginner FAQ
How many devices can one subscription be used on at once?
No device limit. The same subscription can be imported on multiple devices, and concurrent connections cost nothing extra.
Do I need an email address to register?
No. A username and password are all you need — no email address, and there's no email field to fill in the dashboard.
Does the subscription link expire?
The link itself has no expiry date; it keeps pulling as long as your account is active. It stops working in two cases: you reset it in the dashboard, or your account expires.
Can I share my subscription link with a friend?
Not recommended. The link works like a credential, and any traffic your friend uses is counted against your account. If you really want to share, having them register their own account is cleaner.
Summary
A subscription link solves the problem of distributing configuration: when routes change you don't have to edit each device by hand — the client pulls once and stays in sync. Beginners only need to remember three things: copy the address in the right format from the dashboard, import it in the client for your platform and update it regularly, and treat the link like a password — reset it the moment it leaks.
The one-line version: a subscription link is your account's configuration entry point, not a share link to pass around. Store it safely, keep it updated, and replace it when needed — that's more practical than agonizing over which protocol to use.