A subscription link is an address your client requests once to pull down the whole server list. It carries no account credentials and is not the same thing as a plan: the link points to a configuration, while the plan determines your data allowance and expiry date. Keep those two apart and everything that follows — getting, importing, updating and handling a leak — becomes much easier to reason about.
The order below is: first the structure of a subscription link, then where to copy it in the dashboard, then how importing differs across five platforms, and finally what to do after a link leaks plus a checklist for failed imports. Prices and data allowances quoted here match the plans page.
What a subscription link is
A subscription link (subscription URL) is usually an https address ending in a string of random characters. Open it in a browser and you will typically see a block of Base64 text — not a web page, but an encoded node list. The client does three things: request the address, decode the text, and parse each URI line into one server entry.
Once decoded, each line is a node URI. The common prefixes are:
ss://
vmess://
trojan://
vless://
hysteria2://
tuic://Different prefixes map to different protocols and transports. Whether a client can use a given server depends on whether it implements that protocol — point an old Shadowsocks-only client at a list that is mostly VLESS and the result is “import succeeded, no usable nodes”. This is the most common misdiagnosis during import: the link looks broken, but the real problem is a protocol mismatch.
How it differs from adding nodes manually
Adding a node by hand means filling in the server address, port, encryption method, transport layer and obfuscation parameters field by field; a subscription link bundles all of it. With three or five servers the difference is small; at dozens or hundreds, the difference becomes maintenance cost.
| Item | Subscription link | Manual node entry |
|---|---|---|
| First-time setup | Paste one address, import every server at once | Enter address, port, encryption and transport for each server |
| Server changes | Refresh the subscription and it syncs | Add and remove one by one; easy to miss an edit |
| Multiple devices | The same address is reused across platform clients | Retype everything on every device |
| Most common failure | Incomplete copy, wrong format selected | Wrong parameters, missing obfuscation host |
| Best for | Many servers, long-term maintenance | Testing a single server temporarily |
Bottom line: a subscription link solves configuration distribution, not connectivity. If the link is valid but the connection fails, the problem is usually client permissions, the local network or server choice — not the link itself.
Where to find your subscription URL
The subscription address only appears in the user dashboard after you log in; it is never published on marketing pages. VPNEH sign-up needs only a username and password — no email address — so there is no verification email between registering and getting your first subscription address.
The dashboard usually offers several addresses in different formats: generic Base64, Clash config, Sing-box config. They point to the same server list and differ only in serialization. Pick the one that matches your client and do not mix them — pasting Clash format into a client that only understands Base64 usually shows up as “import succeeded but the list is empty”.
Five steps to get and import your subscription
- Log in to the user dashboard and open the subscription block on the overview page.
- Choose the format that matches your client and click copy. Use the copy button rather than selecting by hand — long links are easy to lose trailing characters when dragged.
- Paste it into the client's subscription field and name it after the device or purpose, e.g. “desktop” or “phone”.
- Save, then update the subscription once and check that the number of servers in the client matches the dashboard.
- Connect to one server, then check the exit IP location again to confirm traffic really goes through the server.
A subscription address is a credential. Anyone who has it can import the servers into their own client and consume your account's data. It does not reveal a password, but it works exactly like a usable configuration. So after copying, it is worth a second look at where you are pasting it.
Tip: the address shown in the dashboard does not expire on its own; only a manual reset invalidates it. After switching devices, borrowing someone else's computer, or logging in to the dashboard on a public machine, a quick reset is a good habit.
Importing into clients on each platform
The same subscription address works on all five platforms. The difference is not the subscription format but system network permissions. The authorization dialog on first connection and the system extension you have to allow manually differ from platform to platform.
| Platform | How to import | What to watch on first connection |
|---|---|---|
| Windows | Paste the address on the subscription page and click update | Virtual network adapter mode needs administrator rights; system proxy mode only affects apps that follow the system proxy |
| macOS | Paste the address, or import from clipboard | The network extension must be allowed in system settings on first launch; after granting it, the client usually needs a restart |
| iOS | Paste the address, or scan a code inside the client | The connection is handled by the system network extension; switching from Wi-Fi to cellular means reconnecting |
| Android | Paste the address | Some systems restrict background processes; disable battery optimization for this client |
| Linux | A command-line client reads the subscription address and generates a config, or import into a GUI client | Routing table and permissions are managed locally and vary between desktop environments |
One check you must run after importing
The client showing “connected” only means the local proxy is up, not that traffic goes through the server. Verification means two things: whether the exit IP is located in the region you selected, and whether DNS resolution also goes through the server. Change only the first and leave the second, and domains may still be resolved by local DNS — the symptom is some sites failing to load, or loading a version from the wrong region.
If the client offers routing rules, pay attention to the default action. When a rule sends the target domain to direct connection, that traffic will not go through the server even if the connection is up. To troubleshoot, switch the rules to global mode once; if that works, go back and review the rules one by one.
Update frequency: automatic vs manual refresh
A subscription is not a one-off configuration. Servers being added or removed and entry points being adjusted all show up in the subscription content, and the client has to fetch it again to see them. Most clients let you set an auto-update interval; the usual options are 6, 12 and 24 hours.
- Desktop, always on: a shorter interval is fine, 6 to 12 hours, at the cost of a brief reload of the server list on each refresh.
- Mobile: 24 hours is enough; frequent requests over mobile data bring no benefit.
- Manual refresh: click once when the dashboard announces server changes, or when the client list does not match the dashboard.
Updating a subscription and resetting data are two different things. Monthly plans reset their data on the activation date each month; if you upgrade mid-cycle, the price difference is prorated by remaining days. Data packs last until used up and never expire. Refreshing a subscription only changes the server list the client sees — it does not change data already used and does not extend the expiry date.
Note: some clients rebuild node groups on every subscription update, so manual sorting, grouping and custom rules may be overwritten. If you have edited rules, export the config before updating and import it afterwards.
What to do after a link leaks
The test is simple: has this address ever left your own devices? Posting it in a public chat, pasting it into a forum help thread, or submitting it to an online “subscription converter” page all count. A subscription link does not show an account password, but it is enough for a third party to import the servers into their own client.
- Reset the subscription in the dashboard. The old address stops working immediately and a new one is generated.
- Re-import the new address on every device. Clients still on the old address will fail to update — that is expected, not a fault.
- Check data usage and connection records to confirm there was no unusual consumption.
- Trace the leak path: screenshots, help threads and online converter tools are the three most common.
- If the address was ever submitted to a third-party converter page, treat it as leaked and reset it straight away — do not gamble on it.
- ✅ Copy the subscription address only from the dashboard after logging in, never from third-party sites.
- ✅ Move it through channels you control, not public chats or public repositories.
- ✅ Reset it after switching devices or logging in to the dashboard on someone else's computer.
- ❌ Posting a screenshot of your subscription address in a public community to ask for help.
- ❌ Using subscription collections of unknown origin — both their source and their maintainers are unclear.
- ❌ Pasting the address into an online subscription converter of unknown origin.
Being able to reset is where a subscription link beats a fixed password: the cost of a leak is one re-import, not a new account or a new plan. Treat it as routine maintenance, not incident response.
Checklist for a failed import
Most import failures fall into five categories. Work through them in this order — it is faster than reinstalling the client over and over:
- Empty list: wrong subscription format, or an incomplete copy of the link. Copy it again from the dashboard and make sure no trailing characters were lost.
- Update error 403 / 404: the address has been reset or has expired. Go back to the dashboard for the current one.
- Connected but pages will not load: the client is in system proxy mode and the app in question does not follow the system proxy; or DNS is still resolved locally.
- Only some apps work: a routing rule sends the target domain to direct connection. Switch to global mode to verify.
- Connects then drops immediately: the system network extension is not authorized, or another network tool on the machine is also taking over traffic.
If none of the five explains it, look at the server itself: try a server in a different region. If that connects, the problem is a single server; if not, it is the local network or the client configuration. This step halves the search space.
Bottom line: manage a subscription link as a revocable configuration credential — take it from the dashboard, import it per platform, update it as needed, and reset it whenever you suspect a leak. Do those four things and most “import failed” and “data dropped for no reason” cases can be traced to a specific step.
For the regional spread of servers and server types, see the server list; to confirm plan data allowances and prices, see the plans page. Both match the subscription details described here.