VLESS key, link, and subscription: what they are and how to add them

Keys, links, configs, and subscriptions: what's the difference

A VLESS key and link are the same thing: a vless:// string containing one server. A config is a detailed technical instruction in JSON format. A subscription is a web address pointing to an updated list of your servers.

Think of them like house keys. A VLESS key is a single key to one door. If the lock changes, the key stops working and you have to ask for a new one. A subscription is like a keychain managed by your landlord: if a new entrance opens or a lock is changed, the right key automatically appears on your keychain.

In everyday speech, the lines blur: a subscription might be called a key, and a simple link might be called a config. If a provider offers a choice, always pick the subscription.

What makes up a vless:// link

A VLESS link works just like a website address in a browser: protocol, login credentials, server address, and parameters after a question mark. The format is outlined in an Xray developers' proposal on GitHub and is understood by almost all clients. Here is a fake example that won't connect anywhere:

vless://00000000-0000-4000-8000-000000000000@example.com:443?encryption=none&security=reality&sni=www.example.org&fp=chrome&pbk=EXAMPLE-public-key&sid=0a1b2c3d&type=tcp&flow=xtls-rprx-vision#Example%20server

For a detailed explanation of Reality, Vision, and transports, read our article VLESS explained simply. You shouldn't manually edit anything in the link. Copy it entirely: if you miss the last few characters, the app will reject it or fail to connect.

Links for other protocols are structured similarly, just with a different prefix: vmess://, trojan://, or ss:// for Shadowsocks and Outline keys, and hysteria2:// or hy2://. The common old vmess:// format uses an encoded block of text instead of an address after the prefix. Apps like Happ and Hiddify understand most of these links.

What is a JSON VLESS config

Once an app receives a link, it turns it into a configuration for its core, either Xray or sing-box. This is JSON text containing the server details, routing rules, DNS, and other settings. This is what people call a 'VLESS config' or 'VLESS in JSON'.

In the modern Xray format, our fake server looks something like this (this is a fragment, not the entire configuration):

{
  "protocol": "vless",
  "settings": {
    "address": "example.com",
    "port": 443,
    "id": "00000000-0000-4000-8000-000000000000",
    "encryption": "none",
    "flow": "xtls-rprx-vision"
  },
  "streamSettings": {
    "security": "reality",
    "realitySettings": {
      "serverName": "www.example.org",
      "fingerprint": "chrome",
      "password": "EXAMPLE-public-key",
      "shortId": "0a1b2c3d"
    }
  }
}

Xray config formats change from time to time. In older tutorials, the same data sits inside a vnext block, the transport is defined by network, and the Reality public key is publicKey. If an example from the internet doesn't match the official docs on xtls.github.io, you are likely looking at a different version.

You only need a config if your provider issues settings strictly in JSON, or if you are setting up complex routing yourself. Not all apps can import JSON, and for those that can, the format depends on the core: v2rayNG takes Xray configs, while Hiddify relies on sing-box configs. In all other cases, a link or subscription is enough.

Avoid converting your link to JSON using online converters: you are handing your key to an unknown website. The app will do the conversion internally when you import the link.

What is a VLESS subscription and why it's better than a key

A subscription is a standard https:// link, except it is opened by your VPN app, not a browser. At this address, the provider hosts a list of keys (usually Base64 encoded), which the app unpacks into a server list.

If you open this link in a browser, you will see either a long string of letters and numbers or the provider's webpage. This is normal: the link is meant for the app.

The main benefit of a subscription is that it updates. The app downloads it again on a schedule or when you tap 'Update'. If the provider adds a location, changes a server address, or tweaks Reality settings, you get those updates automatically without needing new links from support.

A single country might have several rows in the subscription. These could be different servers, or the same server using different transports, like TCP with Reality and XHTTP with TLS. If one doesn't work well, try another.

Along with the server list, the provider can transmit the subscription name, update interval, expiration date, and remaining traffic limit. This is why some apps display how many days you have left next to your subscription.

In Byte VPN, a subscription looks like https://bytestand.fun/subscription/… You copy it from your personal dashboard, and it contains all available locations at once, saving you from adding each server individually.

How to add a key or subscription to an app

Keys and subscriptions are added identically, and the process barely changes between apps. The menu names below apply to fall 2026 versions. If your menu looks different, look for a '+' button or words like 'Import', 'Add', or 'Clipboard'.

1. Install the app from an official store: App Store, Google Play, or the developer's website.
2. Copy the entire link from your dashboard or a message sent by your provider.
3. Open the app, tap '+', and choose to paste from the clipboard.
4. Confirm the system prompt for a VPN connection: on iPhone, it appears when adding a profile or connecting for the first time; on Android, it appears upon the first connection.
5. Select a server from the list and tap the connect button.

If you previously added single keys from the same provider, it's best to delete them after adding a subscription. Otherwise, you'll have duplicate servers, and the single ones will eventually stop working.

Sometimes a provider offers a button that directly opens the app instead of a link. The client will then ask if you want to add the profile. Hiddify, for example, says: 'An external link from … wants to add a new profile. Import?' If the button doesn't work, copy the link and add it manually as described above.

Incy

Incy is available for Android (on Google Play), iPhone, and iPad. It was removed from the Russian App Store on October 27, 2026, so on iPhone, you need an Apple ID from a different country, but previously installed copies still work. Learn more about the iOS app situation in our article about VPNs on iPhone. Add a subscription by tapping '+ Add' → 'Paste', and all its servers will appear in the list.

Happ

Happ is available for iPhone, Android, macOS, and Android TV. Add the link the same way: '+' and paste from clipboard. On a TV, you don't need to type the long string with a remote: you can transfer the subscription from your phone via a code on tv.happ.su. Read about setup, common errors, and split tunneling in our article about Happ.

Hiddify

Hiddify is great on Windows. Click 'New profile' or '+' and select 'Add from clipboard': the subscription will appear in your profile list. There are also 'QR code' and 'Add manually' options. More details about the app and its errors are in our article about Hiddify.

Other apps

In v2rayNG, v2RayTun, Streisand, NekoBox, and other clients supporting VLESS, the principle is the same: import from clipboard or scan a QR code. A QR code is just a link drawn as an image, so you can scan it with the app's camera straight from your computer screen. Compare clients in our review of apps for VLESS.

TV and router

On Android TV, Happ is the most convenient choice due to its code transfer feature, detailed in our article on VPN for TV. Routers with VLESS support usually accept the same link or subscription in the VPN import section of their control panel. To see which firmwares can do this, read our article on VPN for routers.

What to do if a key or subscription doesn't add or work

Most of the time, the issue lies with the link itself or because it has expired.

• The app says the link is invalid, or nothing happens after pasting. You probably didn't copy the whole thing, or you accidentally included a space or line break. Messengers sometimes truncate long strings or format parts of them. Copy the link again using the 'Copy' button in your dashboard instead of manually highlighting the text.
• The subscription was added, but the server list is empty. This means the app couldn't download its contents. Check if your internet works without the VPN, then tap 'Update'. If that doesn't help, the subscription might have expired or been reissued.
• The subscription won't update, but the servers inside still work. The app failed to reach the subscription address and kept the previous list. As long as the server settings haven't changed, you can keep using it. Try updating later or on a different network.
• It used to work, but now it doesn't. A single key expires when a provider changes a server or its settings, requiring a new key, whereas a subscription just needs an update. Another possibility: the link was reissued, for example, if you clicked that button in your dashboard.
• The app doesn't recognize some parameters. Older client versions don't know about newer transports like XHTTP or new Reality settings, so update the app.
• The QR code won't scan. Turn up your screen brightness, move your phone back, or transfer the link as text.

If the connection still fails after adding it, try a different server from the list, and then check our guide on what to do if your VPN won't connect.

Can you share a key or subscription?

A VLESS link and subscription grant access to the service you paid for. Anyone who receives them can connect until you change the key. Hence a few rules.

• Never post your link or QR code in chats, on forums, or in stories. A QR code can be scanned from a photo or screenshot just as easily as text.
• If you want to connect a relative, check your provider's rules: some offer separate keys for this, while others let you install a subscription on multiple devices.
• You usually don't need to forward your link to your provider's support team; they can find you by your account. If you send screenshots, mask your UUID and subscription address.
• If your link leaks, reissue your key or subscription in your dashboard, or ask support to do it. The old link will immediately stop working.

Transferring a subscription to your own devices is perfectly fine. It's easy to send to a TV using a code, or to a computer via notes or 'Saved Messages' in a messenger, though you should delete the message afterward.

The dangers of free VLESS keys in channels and chats

Queries like 'free vless keys' and 'free vless subscription' frequently pop up in search suggestions, and there are plenty of channels giving them away. We don't link to them because connecting via someone else's free key is risky.

• The server owner sees your traffic. Everything you open passes through their server. They can't read the contents of HTTPS pages, but they see which websites you visit, when you visit them, and how much data you transfer. They can read unencrypted traffic and, at worst, spoof responses to redirect you to a fake page.
• The key can stop working at any moment. Many people use a public key simultaneously, overloading the server and quickly getting its IP blocked. The owner might shut it down simply because they are tired of paying for it.
• Someone else's subscription changes without your knowledge. Its contents can be swapped at any time: different servers, different owners, and you won't even notice.
• A key can be bait. Sometimes a 'free VPN' comes bundled with an app from an unofficial source or a bot that asks for your phone number and a confirmation code. This is how accounts are stolen and malware spreads.

Public 'subscriptions' on GitHub work the same way: they are lists of servers belonging to other people, and everything mentioned above applies to them.

If you need a free option, choose a provider that openly explains how it makes money. To learn how to verify this, read our article on free VPNs.