What Is a VPN subscription link? Complete Beginner Guide: Get, Import, Update & Leak Response

A VPN subscription link (subscription URL) is an ordinary web address, yet it decides which servers show up in your client. It is generated by the provider in your dashboard; the client fetches it on a schedule and parses the response into a clickable server list. Get three things straight — what it contains, how to import it, and what to do if it leaks — and you have the basics of these clients down.

What a subscription link is: the server list behind one URL

A subscription link is not a server itself; it is the pickup address for your server list. You add it to a client as a subscription source, the client sends one HTTPS request, and back comes a text file: usually a Base64-encoded list of share links, one per line, using protocols such as Shadowsocks, VMess, Trojan, VLESS, Hysteria2 or TUIC. It may also return YAML for Clash / Mihomo, routing rules included. Once parsing finishes, the client turns each line into an entry in the server list.

Break the response down and each server entry holds only a few fields — but every one of them is required for a working connection:

In other words, a subscription link bundles server addresses, protocol parameters and credentials into one string. It does not contain your dashboard password or payment details, but anyone who has it can use those servers — which is why it has to be kept like a credential.

Where to get it: the copy button in your dashboard

Subscription links are generated by the provider and tied to your account, so there is only one route to yours: sign in to the dashboard. Signing up needs only a username and password — no email address — and the subscription section sits on the overview page once you are in.

1. Sign in to the dashboard, open the overview page and find the "Subscription link" section — that is the address for your account.
2. Copy the whole thing. Subscription links usually carry a long token parameter, and a single missing character makes the client update fail — typically a 404 or an empty server list.
3. Pick an import method. Most clients can read straight from the clipboard, and the dashboard may also offer a QR code or one-click import; the QR code and the link are the same credential, so sending a screenshot out is the same as leaking it.
4. Copy it again whenever you need it. The link is tied to your account and can be copied from the dashboard at any time, so there is no need to keep a separate backup; if your usage varies, you can start with a data pack, which never expires.

If you prefer to follow along step by step, the guides cover each platform with screenshots, in the same four steps as above.

Importing into a client: step by step for each platform

The menu names differ between platforms, but the flow is the same: add a subscription → update it once manually → the server list appears. The table below lists common clients and where to find the entry point.

The three places imports get stuck

• Protocol support: the original Clash core does not understand Hysteria2 or TUIC; you need a newer core such as Mihomo (Clash Meta) or sing-box. If the server list is empty after updating, check the core version first, then the link.
• Updates must go out over a direct connection: updating a subscription is just an ordinary HTTPS request. If the current proxy setup is not working, switch back to a direct connection before updating; most clients also offer an "update without proxy" option.
• One link works in several places: the subscription link for an account can be imported on multiple devices, with no limit on how many are online at once, so there is no need to generate one per device. Client downloads are on the dashboard download page.

If you are comfortable on the command line, a few shell lines will confirm whether a subscription link works:

# A subscription link copied from the dashboard looks like https://example.com/edge-api/client/subscribe?token=...
SUB_URL="https://example.com/edge-api/client/subscribe?token=..."

# Fetch and decode: most subscriptions return Base64-encoded share links, one server per line
curl -sL "$SUB_URL" | base64 -d | wc -l

# A decoded line looks roughly like this (203.0.113.10 is a documentation address, not a real server)
# ss://[email protected]:8388#HK-Direct

# On Linux, write it straight to a config that mihomo / Clash can use
curl -sL "$SUB_URL" -o ~/.config/mihomo/config.yaml

The number of lines returned is usually the number of servers. If decoding fails, the subscription is returning YAML rather than a Base64 list — import it as a config file instead.

How often to update: the refresh cycle

The point of a subscription link is that it follows the server side. When the provider adds a region, retires a route or changes an entry domain, you do not need to sign up again or reinstall the client — one update pulls the current server list. Most clients support automatic updates, commonly every 24 hours or on startup; the manual update option usually sits on the subscription entry itself.

• When to update manually: a route suddenly stops connecting, you have changed networks (from home to the office, for example), the client says the subscription has expired, or you see server changes on the routes page.
• When an update fails: first check that the link was copied in full, then check that the update request goes out over a direct connection; some networks block subscription domains, and retrying on another network usually fixes it.
• After updating: an update only refreshes the list, it does not change your choice. If the server you had selected is still there, it stays selected; if not, the client falls back to the first entry.

The size of the route pool is what makes subscription updates worthwhile. Here is the current scale:

After importing: routing rules and DNS leaks

A subscription that imports cleanly and loads web pages only proves that traffic flows. Two more things need checking before everyday use is stable.

Routing rules: what goes direct and what goes through a route

In rule mode, the client sorts traffic into three buckets by domain and IP: sites in mainland China go direct, international sites go through a route, and ad and tracking domains are rejected outright. Clash-style subscriptions usually ship with rule sets that work as soon as they are imported; clients such as v2rayN and v2rayNG need you to pick a routing mode yourself (bypass mainland China / global). Rule mode avoids pointless detours: sites in mainland China keep their original speed, and only requests that need a route pass through a server. As for route types, IEPL is the fit for scenarios that demand stability, while relay and direct routes each suit different cases.

DNS leaks: two consequences and one fix

If the client hands domain resolution to the DNS of your local network, two problems follow. First, the resolved result does not match the exit region of your route, so international sites resolve to a local node and speed drops noticeably. Second, your local DNS sees exactly which domains you have visited. The fix is to enable remote DNS or DNS leak protection in the client, or use fake-ip mode so that name resolution happens on the proxy side.

What to do if the link leaks: three steps to take right away

Common ways a subscription link leaks: a screenshot posted in a group chat, pasted into a forum asking for help, saved to a public cloud drive, or left on the clipboard of a shared computer. Once you notice, do three things in order.

• ✅ Reset (regenerate) the subscription link in your dashboard — the old link stops working immediately, and this step is what limits the damage.
• ✅ Import the new link on every device and delete the old subscription entry, so the client stops pulling a dead address.
• ✅ Check the data usage and sign-in history on your account for activity that is not yours.
• ❌ Do not stop at deleting the subscription entry in the client — the old link still pulls servers for whoever holds it.
• ❌ Do not change your login password instead of resetting the subscription link; they are two separate credentials, and a new password does not necessarily invalidate the old link.

Cutting the odds of a leak day to day is simple too: keep the subscription link only in your client and your password manager; when family members need it, have each of them sign in and import it rather than forwarding the link around.

FAQ