Subscriptions
The subscription is the only thing a client ever sees. From one link their app gets the list of locations in whichever format it understands.
Formats
The format is chosen by the app's User-Agent. Rules are checked top to bottom and the first match wins; if none matches, a built-in list of known apps decides.
| Format | For |
|---|---|
| Xray JSON | Happ, Streisand, v2Box, NekoBox |
| Clash / Mihomo | Clash Meta, FlClash, Stash |
| sing-box | sing-box, Hiddify |
| base64 list | v2rayNG, Shadowrocket and anything unknown |
| Web page | A browser: apps for the platform and an install button |
You can check what a particular app will get from inside the panel: the Response rules section, the “Paste a User-Agent” field.
A server of its own
The subscription service moves to another server and another domain: then blocking the panel does not cut clients off from their configs, and the subscription machine has no database access at all.
SUB_MODE=api
PANEL_URL=https://panel.your-domain
SUB_SERVICE_TOKEN=<key from the panel>The key is issued in Settings → Subscription service and shown once. The same page hands you the install commands and a Caddy block.
Devices and the limit
Apps identify themselves with headers (x-hwid, x-device-os,
x-device-model, x-app-version). From those the panel keeps the
client's device list and enforces the plan's limit.
The limit is only checked for a new device: one already registered keeps working even if you later lower the limit — otherwise somebody would suddenly lose access on the phone they used yesterday.
Over the limit, the client gets a clear line in the location list rather than emptiness: how many devices are taken and what to do about it.
curl do not count as devices: they send none of
those headers.When a subscription hands out nothing
- Time has run out, or traffic has.
- The client was switched off by an administrator.
- Not one inbound from their squads is up on a live node.
- The device limit is used up.
In every case the reason arrives in place of the locations — the wording is set in
Subscription settings and supports {date}, {days} and
{tariff}.
Who has been asking
The Subscription requests section shows who fetched the link, with what and when. Three requests from one address is normal — that is the refresh interval. Dozens of different addresses within an hour means the link has leaked: revoke the subscription from the client's card, which changes the short identifier and kills the old link.