How to Add Clash Subscription Links: Complete Multi-Platform Import Tutorial

What Counts as a Clash Subscription?

In everyday language, people say subscription link when they mean a remote URL that returns a Clash-compatible configuration—usually a YAML document describing proxies, proxy-groups, and rules. Your service provider generates that address in a customer dashboard. The client downloads it on a schedule you control, merges it into a profile, and turns the text into a selectable list of nodes inside the app.

That URL is sensitive. Anyone who possesses it can often fetch the same configuration you use, which is why screenshots, screen recordings, and pasted chat logs are risky. Treat the link like a password: store it in a password manager, rotate it when the dashboard allows, and avoid opening it in a shared browser profile unless you understand the exposure.

Links, Files, and QR Codes You Will See

Most providers hand you an https:// endpoint. Some also offer http:// variants for legacy networks; prefer HTTPS whenever possible so the payload is not trivially observable on the wire. A smaller subset exposes import shortcuts or deep links that open a particular client directly—those strings vary by app and are not standardized across the whole ecosystem.

Besides remote URLs, you may receive a .yaml or .yml file, or a QR code that encodes the same URL. File import is useful when a network blocks automated fetches but allows you to sideload text manually. QR workflows shine on phones where typing long tokens is painful.

Before You Paste Anything

Confirm the clock on your device is accurate. TLS validation and some token-based URLs behave oddly when the system time drifts by minutes or hours. Next, disable conflicting tools temporarily: another VPN, an enterprise SSL inspector, or a filter that rewrites HTTPS can make the subscription request return HTML error pages instead of YAML—your client will not parse that as proxies.

Some dashboards require a specific User-Agent string or an extra query parameter on the URL. Copy the address exactly as shown; do not trim trailing slashes or arguments unless support tells you to. If the provider documents a recommended User-Agent, mirror it in the subscription settings of your client when that field exists.

Wi-Fi, Cellular, and Captive Portals

Hotel and airport networks often intercept the first HTTP request until you click through a portal page. That breaks background subscription updates. Complete the portal login in a browser, then retry the import from the client. On cellular, check whether your plan blocks non-standard ports; rare MVNOs interfere with outbound connections that are not on 443.

Windows: Adding a Subscription in Typical GUIs

On Windows, mainstream Mihomo-based apps expose a Profiles, Subscriptions, or Config pane. Open it, choose Add or New subscription, paste the URL, give it a readable name, and save. Press Update, Download, or Refresh once to force the first fetch.

After a successful pull, open the Proxies or Nodes screen. You should see groups such as Auto, Manual, or provider-defined names, each containing servers. If the list is empty, skip ahead to the troubleshooting section—do not assume the operating system proxy is misconfigured until the profile actually contains nodes.

For a full desktop walkthrough that also covers system proxy versus TUN after the profile loads, see our Clash Verge Rev tutorial for Windows and macOS.

Background Updates and Permissions

Windows may ask for firewall permission the first time the core listens on a local port. Allow access on private networks unless you have a reason to restrict it. If you run the portable edition from a restricted folder, automatic updates to subscription files might fail silently—check the log panel for permission errors.

macOS: Gatekeeper, Sandboxing, and First Fetch

Install your chosen app into Applications, launch it, and navigate to the same subscription screen described for Windows. macOS will prompt for network permissions the first time the helper tries to reach the remote URL—approve it.

If the subscription never populates, open the in-app log viewer before changing random YAML. macOS sometimes blocks helpers until you explicitly allow them under Privacy & Security. TUN-capable clients may need additional approvals for network extensions; that affects routing rather than the initial HTTPS download, but it is worth resolving before you chase false DNS issues.

Linux: Desktop Clients and Headless Cores

Linux users might run a graphical front end or a systemd-managed mihomo binary with a controller API. GUI flows mirror Windows: add remote subscription, set an interval, refresh manually once. For headless setups, providers still give you a URL; you wire it into proxy-providers or a downloaded config according to upstream documentation.

Ensure the user running the service can resolve DNS and reach the internet without a stale HTTP proxy environment variable. Corporate shells sometimes export HTTP_PROXY in a way that loops traffic back into the local core before it is ready, producing confusing fetch failures.

Android: FlClash and Similar Clients

On Android, open your client, locate Profiles or Subscription, tap add, and paste the HTTPS link. Grant VPN preparation permission when prompted; without it, the app may still fetch the YAML but cannot steer traffic later.

Many builds offer import from clipboard when they detect a Clash URL. That saves time when your provider sends a long token through a messenger app. After import, run an update and open the node list to confirm latency tests return numbers instead of timeouts.

Android battery optimizations can delay background refresh. If your provider changes servers midday, whitelist the client or expect to refresh manually when you notice stale endpoints.

iOS and iPadOS: TestFlight, Store Builds, and Profiles

Apple’s platform policies mean Clash-compatible apps change names and distribution channels more often than on desktop. The pattern nonetheless repeats: create a profile, paste the subscription URL or scan a QR code, download, then select an active policy group inside the client’s UI.

Because sideloading and region availability differ, this guide stays descriptive rather than naming a single storefront build. Whichever app you use, verify that it supports your provider’s protocol stack—older binaries without Mihomo may not understand newer outbounds even if the subscription downloads successfully.

QR Codes, Clipboard Detection, and One-Tap Import

When the dashboard shows a QR code, use the in-app scanner where possible instead of a random third-party reader that logs history. If the client lacks a scanner, iOS and Android camera apps can often recognize URLs and offer to open them—confirm the destination before tapping through.

Clipboard-based import is convenient but brittle: copying unrelated text afterward can overwrite the buffer before you finish the wizard. Import immediately after you copy the provider link.

Importing a Local YAML Instead of a Remote URL

Some users archive a sanitized config file for travel. Most GUIs offer Import from file or let you drag a .yaml into the profile list. After import, the client may still treat the document as static—if you need ongoing updates, prefer the remote URL workflow or re-import manually when the provider rotates nodes.

When merging a local patch with a remote subscription, use the client’s mixin or override layer if available. Editing the downloaded provider file directly works until the next refresh overwrites your edits.

Refresh Intervals, Manual Updates, and Rate Limits

Automatic refresh balances freshness against provider load. Six to twenty-four hours is a typical window. Aggressive one-minute polling can trigger HTTP 429 throttling or temporary bans. Pair automation with a manual refresh after maintenance announcements.

If you operate multiple profiles—work, personal, testing—give each subscription a clear name. Switching profiles is faster than mutating a single YAML when experiments go wrong.

Troubleshooting: Empty Lists, TLS Errors, and Wrong Content

Zero nodes after update. The response body was not valid Clash YAML. Common causes include expired tokens, blocked geography, captive portals, or a provider message rendered as HTML. Read the log line that cites HTTP status codes.

TLS handshake failures. Corporate SSL inspection replaces certificates; you may need to trust an enterprise root or fetch from an unrestricted network once to confirm.

403 or 401 responses. The subscription secret changed or the URL was rotated. Log into the provider dashboard and regenerate the link rather than hammering the stale endpoint.

DNS works in browser but not in client. Split DNS setups sometimes send the client through a different resolver. Align DNS settings between OS and profile, or consult our documentation hub for deeper DNS tuning once basics are stable.

Habits That Keep Imports Reliable

Keep an offline copy of each subscription URL outside the client. After major app updates, verify one manual refresh before assuming the background scheduler broke. When you rotate a link at the provider, update every device that still stores the old value.

Compared with juggling one-off manual proxies, a maintained Clash profile with sane refresh rules usually delivers a smoother experience: fewer stale endpoints, clearer grouping, and room to grow into rule-based routing when you are ready.

Closing Thoughts

Adding a Clash subscription is conceptually simple—paste a URL, download once, pick a node—but the ecosystem spans many GUIs and permission models. If you remember that the fetch must return real YAML, that HTTPS and clock skew matter, and that each platform has its own approval prompts, most import issues shrink to a short checklist instead of a mystery.

Once your profile loads reliably, you can explore advanced topics such as TUN mode or custom rules without fighting empty proxy lists first. When you want installers sorted by platform in one place, skip scattered release pages and start from our hub.

→ Download Clash for free and experience the difference.