August 6, 2026 · Getting Started · About 8 minutes

Shadowrocket Beginner FAQ: App Store Purchase, Subscription Setup & Connection Troubleshooting

Answers to 10 common Shadowrocket questions: App Store purchase, where to add a subscription URL, connection issues, and choosing Global Routing options.

At a glance

Getting started with Shadowrocket involves five steps: purchasing the app, adding an existing subscription, selecting a server, allowing the VPN configuration, and checking the connection. This guide is for new users who already have a service provider and subscription. It distinguishes the app purchase from server details and routing rules. First establish and verify one connection, then configure automatic updates and On Demand. Avoid changing several settings at once, so you can identify the cause of any issue.

1. Why buy Shadowrocket? Does the purchase include a service?

Shadowrocket is a closed-source commercial app available as a one-time purchase through the App Store. The purchase covers use of the client, not a service provider’s plan. Buying the app does not include a server subscription. Get your subscription URL from your service provider; purchasing the app does not automatically add usable servers.

Check the App Store product page before purchasing rather than relying on the name in search results. The price, system requirements, and purchase eligibility are as listed on the App Store page. Shadowrocket is primarily used on iPhone and iPad; check the same store page for compatibility with Mac, Apple TV, and Apple Vision.

2. Where do I add a subscription URL?

Add a subscription as a Subscribe entry; don’t paste it into Config as a rules file. Home manages servers and subscriptions, Config manages routing configurations, and Settings manages app preferences. Each serves a different purpose. Before importing, identify whether you have a subscription URL, details for a single server, or a routing configuration.

  1. Get the URL

    Get the subscription URL from your service provider. Copy it in full without changing or removing query parameters. Don’t use the provider’s dashboard login page URL as the subscription URL.

  2. Choose the type

    Open Home, tap “+” in the upper-right corner to open Add Server, then choose Subscribe under Type.

  3. Enter the URL

    Paste the URL into URL, add a Remark if needed, and save. Check that no spaces or line breaks were added at either end.

  4. Check the list

    Go back to Home and confirm that the subscription group and server entries appear. If the list is empty, check the import message and make sure the URL is still valid. Avoid adding the same subscription repeatedly.

3. Why can’t I connect right after importing?

A server list means the subscription was parsed; it doesn’t mean a connection has been established. On your first use, tap a server entry in Home and check for the selection indicator on the left before using the connection toggle at the top. Selecting a server before testing helps distinguish an imported server from an active connection.

With a policy group, the final outbound route may also depend on the policy selected in the current Config. To troubleshoot, start with a clearly selected server and a known configuration. Don’t change policy groups, DNS, and protocol settings at the same time.

4. What should I check if the connection toggle won’t stay on?

The first time you connect, the system asks to add a VPN configuration. Allow it in the system prompt and complete any required authentication. If you previously declined, try connecting again from Home and see whether the prompt reappears. If the toggle immediately turns off, check whether authorization is incomplete or the server configuration is causing the connection to fail.

  1. Check that a server is selected in Home and that all required fields are filled in.
  2. Turn on the connection toggle again and approve the VPN configuration in the system prompt.
  3. On iPhone or iPad, check the VPN configuration under Settings → General → VPN & Device Management. The wording may vary by system version.
  4. If your device is managed by an organization and adding VPN configurations is restricted, ask the device administrator about the policy. Don’t repeatedly delete system configurations.

If the toggle stays on but webpages still fail to load, move on to connection troubleshooting rather than revisiting installation or purchase. A VPN-connected status confirms the tunnel state; it doesn’t guarantee that every destination, DNS query, or service provider route is working.

5. Which Global Routing mode should I choose?

For everyday rule-based routing, use Config after confirming that the right configuration is enabled. Proxy and Direct can help isolate an issue by changing how traffic is routed, but they won’t fix an incorrect server password, an expired subscription, or an unreachable address.

Config

Recommended

Routes connections according to the rules and policies in the current Config. The result depends on which rule matches; it doesn’t simply mean that all traffic for a particular region goes direct.

Best for: Everyday rule-based routing with a verified configuration.

Proxy

Routes general traffic through the proxy path. Use it for comparison to see whether an issue is related to rule selection; the server and network must still be working.

Best for: Briefly testing the proxy path or isolating a routing rule issue.

Direct

Uses a direct connection to the destination without relying on a proxy server. If a page loads in this mode, that doesn’t mean the proxy server is working.

Best for: Comparing results with your device’s regular network connection.

Scene

Applies routing behavior based on configured scene conditions. Check the conditions and corresponding settings first; this isn’t the default troubleshooting option.

Best for: Users who have set up and understand scene configurations.

6. What’s the difference between Config and a subscription?

A subscription provides a list of servers to choose from. Config determines how a connection is handled according to routing rules. Updating a server subscription doesn’t update the routing configuration. When using Config mode, check which file is active on the Config screen; seeing a file in the list doesn’t mean it’s in use.

The examples below show rule syntax only; they aren’t a complete configuration. Rules are usually evaluated from top to bottom, and the first match determines the policy. FINAL handles connections that haven’t matched a prior rule. Policy names must also match those defined in the current configuration.

DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
GEOIP,CN,DIRECT
FINAL,PROXY

7. When should I update a subscription, and what if it fails?

If your service provider changes server addresses or settings, update the subscription to get the latest details. An update refreshes the list; it doesn’t verify that every server can connect. Update the subscription from Home, then check for error messages and changes to the entries. Your service provider determines the subscription’s validity period and access rights.

The update keeps timing out. Should I import the subscription again?

First, check that your device has a working network connection, then try updating the subscription again from Home. If the subscription URL requires a proxy connection, check the Update via Proxy setting under Settings → Subscribe only if you already have a working proxy connection. Enabling this setting won’t establish a working connection by itself.

I’m seeing an authentication error. Which setting should I change?

First, check that the subscription URL is complete and ask your service provider whether the access credentials have changed or service has been paused. Once you have a new, valid URL, update the corresponding Subscribe entry in Home. Don’t try to fix subscription authentication by changing the server port.

The server I selected disappeared after updating. What should I do?

Check the latest list in the subscription group. If your service provider removed or renamed an entry, select a server that’s actually listed and run Connectivity Test. Don’t rely on the old server name to identify the current route.

8. Why won’t webpages load even though the VPN is connected?

Check each layer in order: server → routing mode → destination access. A successful Connectivity Test means the destination was reachable under those test conditions; it doesn’t guarantee that every website or protocol will work. Interpret a failure alongside the error message and results from other destinations. Don’t draw conclusions from a single latency number.

  1. Run Connectivity Test for the selected server in Home and note whether it succeeds, times out, or returns an error.
  2. Briefly compare Proxy with Config. If Proxy works but Config fails, first check the matching rules, policies, and relevant DNS settings in Config.
  3. If both modes fail, check that the server address, port, and credentials match the details from your service provider, then try another existing server from the same subscription.
  4. If only one destination fails, note its domain and error type rather than resetting all your settings.

9. Should I turn on On Demand right away?

Connect manually and verify the connection before setting up Settings → On Demand. On Demand triggers connection behavior based on configured conditions; it doesn’t repair an unhealthy server. Adding automatic triggers before confirming that a manual connection works can make connection failures and mismatched trigger conditions harder to tell apart.

10. Do I need to buy Shadowrocket again on a new iPad or after reinstalling?

In the App Store, use the original purchase account to check your purchase history or whether the product page offers redownload. Restore eligibility and purchase availability are as listed on the App Store page. Your app purchase record and service provider account are separate. After restoring the app, check your subscription, active Config, and connection permissions again.

Moving to a new device: Check your purchase history and connection settings separately

On the original device
  • Confirm which App Store account you used to purchase the app.
  • Note the name of your current Config and your Global Routing mode.
  • Keep your subscription credentials secure. Don’t share them in public screenshots.
On a new device or after reinstalling
  • Check your purchase status and compatibility in the App Store.
  • Check whether your configuration was actually restored. If the subscription is missing, get it from your service provider.
  • Select a server, authorize the VPN configuration, and verify the connection again.

Restoring the app doesn’t guarantee that all connection settings are intact or that your service provider allows unlimited simultaneous devices. Check device limits with your service provider.

After completing these 10 checks, keep a known-good baseline for future troubleshooting: a known server, a known Config, and a clearly defined Global Routing mode. Change one setting at a time and note what happens before and after. For more on rules and policies, read the complete manual. Look up interface terms in the glossary.

Get Shadowrocket on the App StoreVerify the developer and app ID