A subscription URL is a dedicated address that lets a client retrieve connection settings, usually with access credentials linked to your account. Import it into a compatible client, refresh the configuration, choose a route, and test the connection. It is not a payment link or a public webpage to share.
Subscription URLs, Nodes, and Plans: What's the Difference?
Think of a subscription URL as a link to retrieve a configuration list. When a client accesses it, the client reads the data returned by the service and creates a list of routes or configurations locally. If routes change, refresh the subscription to get the updated list instead of re-entering connection settings one by one.
A node is an individual connection endpoint in that list, usually including a server address, port, protocol, and authentication details. A plan defines the account's service benefits, such as data allowances and their validity rules. A successful import only means the client accepted the configuration; it does not confirm that the plan is active or every route can connect.
Also distinguish a paid subscription from a configuration subscription. The former is a billing arrangement; the latter is how a client retrieves configuration. Even with a data package, you may manage routes through a subscription URL. Selecting “Update subscription” in a client usually does not renew your account.
Getting a Subscription and Client from the User Dashboard: Get
VPNLay requires you to sign in to get your subscription. You can create an account with a username and password; no email address is needed. Sign in through the account panel on our website. Don't rely on configuration files forwarded by strangers to verify a service's identity.
- Check your account status. In the panel, review your plan, remaining data, and other relevant status details. If your account has no active benefits, check the panel's guidance rather than repeatedly switching clients.
- Choose a client for your operating system. Open the client downloads page and follow the instructions for your system. Sign in to get a client for Windows, macOS, Android, or Linux; the iOS client download requires an active plan.
- Find the subscription configuration option. Copy the URL from the subscription or configuration instructions shown in the panel. Labels vary between interfaces; make sure you copy the full link intended for client import, not the panel's address from your browser bar.
- Copy the entire URL. Don't remove parameters after the question mark or include punctuation, spaces, or line breaks added by a chat app. Go straight to the client after copying to avoid leaving credentials in a shared clipboard.
If the panel offers both a copy option and a link that opens the client, either way the configuration still needs to be imported. Automatic app launching depends on system and app associations. If the app doesn't open, the subscription may still be valid; try importing it manually. Don't paste the URL into a search engine to check whether it's valid.
How to Import on Each Platform: Check the Format First
Importing depends not only on your operating system but also on the subscription format the client can read and the protocols it supports. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are different protocols or technologies; changing a link's name won't convert one into another. Check the panel and client instructions for the configurations currently available from VPNLay.
| Platform | What to do during import | What to check before connecting |
|---|---|---|
| Windows / macOS | Add the remote URL in the configuration or subscription manager, save it, and refresh | Select the imported configuration, then enable the system proxy or supported traffic-capture mode as instructed |
| iOS | First check that your plan is active and that you meet the client download requirements, then import a compatible subscription | When connecting for the first time, review the system prompt requesting VPN configuration permission |
| Android | Import using the subscription URL, then check whether the routes were parsed successfully | Confirm system VPN permission and check whether per-app routing is enabled |
| Linux | Load a compatible configuration format using the relevant graphical client or core documentation | Check which configuration file is running, the proxy environment, and how app traffic is routed |
A typical workflow is to open the client's configuration manager, add a remote subscription, paste the URL, name and save it, then refresh. Once the routes appear, select the configuration and route you want, then connect. Button labels vary by app, so don't look for wording copied from screenshots of another client.
If you see “Unsupported format” or “Parse failed,” first check whether the panel offers an option for your client, then check the client version. Don't change protocol fields at random, disable certificate checks, or give the full URL to an unfamiliar website. Before converting formats, find out whether the process sends your token and node credentials to a third party.
On Linux, distinguish between “file saved” and “configuration loaded.” Some cores don't manage remote subscriptions like graphical clients do; you may need a companion tool to retrieve the configuration and reload it as documented. Don't use the same configuration with different cores without checking first: field names and rule syntax may not be compatible.
How Often to Update and How to Confirm It Worked
Updating a subscription retrieves the remote configuration again; it doesn't mean repeatedly disconnecting and reconnecting. Refresh after the initial import, when a service notice announces route changes, when an existing endpoint stops working, or when the panel explicitly asks you to update. Use a sensible automatic update setting if your client offers one; there's no need to refresh manually over and over.
If automatic updates fail, check the last successful update time and the error message first. A sleeping device, a client that isn't running, or an update request routed through an unavailable proxy can prevent a scheduled update from completing. Clients also handle local edits differently. Read the documentation before editing a remote configuration so an update doesn't overwrite custom rules.
- ✅ The update history shows success, and routes appear in the configuration—not just the saved subscription name.
- ✅ The configuration you just updated is active, and the selected route isn't still using an old configuration or another service.
- ✅ Test with the app you actually need to use and check the client's connection logs to confirm requests are routed through the proxy or directly as expected.
- ✅ Check DNS and routing rules. When testing your apparent exit location, also consider browser cache and the app's own proxy settings.
- ❌ Don't treat a connection icon in the status bar, a node name, or a single latency test as proof that every app is using the connection.
A system proxy usually affects only apps that follow those settings. Modes such as TUN may cover more traffic, but still depend on routes, permissions, and exclusion rules. Split tunneling sends some requests directly, so an unchanged exit location when visiting mainland Chinese websites isn't necessarily a fault. First check which rule matched the destination domain.
A DNS leak occurs when domain lookups don't follow the expected route. A changed web exit location alone doesn't prove that DNS requests are taking the expected path; encrypted DNS built into a browser may use separate settings. Check the client's DNS configuration, connection logs, and test results together. Don't draw conclusions based only on the listed region of a DNS resolver.
Troubleshoot Subscription Failures, Update Errors, and Connection Problems
First identify where the problem occurs. Failing to retrieve a configuration is different from having routes appear but being unable to access an app. Pinpointing the stage helps avoid repeatedly deleting and reinstalling a working subscription or blaming the service for a local settings issue.
Can't Get the Subscription URL
Sign in to the panel again and check that you copied the full URL, that an old token hasn't been replaced, and whether the account shows any relevant status messages. If a network request fails, also check the connection path used by the client to update the subscription. An error page downloaded in place of the configuration can also cause a parse failure, so don't assume the format is wrong based only on the error label.
Routes Appear, but Won't Connect
Check your active benefits, remaining data, system clock, and client version, then review the specific connection error. VPNLay monthly subscription data resets each month on the activation date, not on the first day of the calendar month. Data packages remain valid until used up and never expire. Updating a subscription won't restore data that has already been used under either billing option.
Also check for other proxy apps competing for system settings or apps outside the proxy's coverage. If you compare routes, keep the target app and test conditions the same. IEPL, relay, and direct connections describe different route architectures, not subscription file formats; importing again won't change one route type into another.
If Your Link Is Exposed: Revoke the Old Credential, Then Update Your Devices
Treat a full subscription URL sent to someone else, added to a public repository, or shown in a screenshot with its QR code as potentially exposed. A QR code may encode the full subscription credentials, so it's no safer to share publicly than the plain-text URL. Deleting a message from a chat doesn't confirm that no one saved it.
- Stop sharing it and remove copies you can control. Remove sensitive content from public documents, screenshots, and repositories. If version history or shared backups are involved, check whether older copies can still be accessed.
- Look for an option to reset or regenerate it in the panel. Read the instructions and confirm whether the action affects subscription credentials or other account details. If there's no such option or the scope is unclear, contact support through a support ticket and ask them to invalidate the old credential.
- Confirm what the reset invalidates. Replacing the token used to retrieve configuration may not also rotate node authentication details already downloaded to your devices. Check the panel instructions or ask support whether you need to take further steps to invalidate old connection credentials.
- Update all your devices. Import the new URL into each client, remove the old subscription and any configurations you no longer use, then check that connections work.
- Review unusual activity and shared sources. Check available data and account records, and turn off cross-device clipboard sharing if you don't need it. If your account password was also exposed, change it too.
When submitting a support ticket, include your system, client name, exact error message, and what you were doing when it occurred. Hide the full subscription URL, QR codes, and authentication fields in screenshots. Don't paste your full configuration into a public discussion just to speed up troubleshooting. If sensitive information is needed, first verify the official support channel and submission method.
Key Takeaways for Beginners
Treat a subscription as a sensitive, refreshable configuration link—not a public URL. Get the format that matches your client from the panel, then check the update results and actual traffic routing after import. If something goes wrong, distinguish configuration retrieval problems from connection problems. If the link is exposed, focus on invalidating the old credentials rather than simply copying the URL again.
Keep a device list you can understand, noting which clients use the current subscription. There's no need to save the full URL in ordinary notes and pass it around. For plan rules, see Plans and Data Packages. For connection methods, read the technical reference and follow the instructions for your client.