Xray outbound JSON: server configuration

A node file is an object containing an outbounds array. Manual single-node editing requires exactly one element. Normal file/text import can extract multiple nodes. Use Servers → Add server → Manual JSON, or Import file.

The root is not a bare outbound object. Routing, DNS and inbounds in an ordinary server import are not installed as a full configuration.

Collect the server’s actual parameters

Area	Required information
Identity	Display `tag`, protocol, server address and numeric port
VLESS / VMess	Actual user UUID; provider’s encryption/security and flow where applicable
Trojan / Shadowsocks / SOCKS	Password, encryption method or username/password as required by that protocol
Transport	Provider’s network, path, Host, service name and other transport parameters
TLS	Whether enabled, certificate server name and optional provider-required ALPN/fingerprint
REALITY	Server name, fingerprint, public key/password, short ID and required flow

Do not infer these values from a server’s display name or country. Do not add allowInsecure, TLS bypasses or a Vision flow merely to make an error disappear. Match the server configuration.

VLESS over TLS

Template: replace server.example.com, port and dummy UUID; confirm that the server uses RAW/TCP with TLS. The TLS server name can differ from the address: copy the provider’s value.

JSON: outbound-vless-tls.json

{
  "outbounds": [
    {
      "tag": "My VLESS server",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "server.example.com",
            "port": 443,
            "users": [
              {
                "id": "00000000-0000-4000-8000-000000000001",
                "encryption": "none"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "raw",
        "security": "tls",
        "tlsSettings": {
          "serverName": "server.example.com"
        }
      }
    }
  ]
}

For XHTTP, replace the transport with the provider’s network: "xhttp" and xhttpSettings (host, path, mode, and any required extra). For WebSocket use network: "ws" and wsSettings (host, path). These are alternatives, not settings to combine indiscriminately. For gRPC use the provider’s grpcSettings.serviceName.

VLESS over REALITY

Template: the public key placeholder is deliberately unresolved. Replace it and every provider-specific value before saving. realitySettings.password here carries the server’s public key, not its private key. Add user flow only when required.

JSON: outbound-vless-reality.json

{
  "outbounds": [
    {
      "tag": "My REALITY server",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "server.example.com",
            "port": 443,
            "users": [
              {
                "id": "00000000-0000-4000-8000-000000000001",
                "encryption": "none"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "raw",
        "security": "reality",
        "realitySettings": {
          "serverName": "cover.example.com",
          "fingerprint": "chrome",
          "password": "REPLACE_WITH_REALITY_PUBLIC_KEY",
          "shortId": "0123456789abcdef"
        }
      }
    }
  ]
}

VMess over WebSocket and TLS

Template: replace the host, UUID, path and transport details. This is a normal Xray outbound, not the retired vmess://Base64(JSON) VMessQrCode format.

JSON: outbound-vmess-ws.json

{
  "outbounds": [
    {
      "tag": "My VMess server",
      "protocol": "vmess",
      "settings": {
        "vnext": [
          {
            "address": "server.example.com",
            "port": 443,
            "users": [
              {
                "id": "00000000-0000-4000-8000-000000000001",
                "security": "auto"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "ws",
        "security": "tls",
        "wsSettings": {
          "path": "/proxy",
          "host": "server.example.com"
        },
        "tlsSettings": {
          "serverName": "server.example.com"
        }
      }
    }
  ]
}

Other proxy protocols

The same envelope preserves complete protocol settings; OneXray does not rebuild nodes from a fixed form.

Trojan: settings.servers contains address, port, password; transport/TLS belongs in streamSettings.
Shadowsocks: settings.servers contains address, port, method, password; copy the provider’s exact cipher/key requirements.
SOCKS: settings.servers contains address, port, and optional users: [{"user":"…","pass":"…"}]. SOCKS itself is not encrypted; do not describe it as TLS.
Additional Core protocols should be used only when the bundled Core supports their exact JSON. Lack of a standard share URI does not imply lack of native JSON support.

Protocol references: VLESS, VMess, Trojan, Shadowsocks, SOCKS. Check the version boundary before using newer fields.

Runtime server dialing

In Smart, ordinary Custom and All VPN modes, Server dialing manages resolution and Happy Eyeballs on physical proxy connections. Saved node JSON, TLS SNI and HTTP Host stay unchanged. Global dialing preferences do not apply to Advanced templates, complete provider configurations or Raw JSON.

Naming, dependencies and sharing

Use tag for the node name. Do not generate the old name alias or abuse sendThrough. Normal mode assigns runtime tags, so another imported node’s display tag is not a stable cross-node reference. For a final exit use Smart Routing’s final-exit selection; for fully specified chains use Raw JSON.

Do not put cross-node dialerProxy or proxySettings.tag references in an independent node template. Keep dependencies together in Raw JSON instead.

JSON preserves more information than standard share links. VMessAEAD/VLESS links, Hysteria2, Shadowsocks, SOCKS and Trojan are supported; legacy VMessQrCode is not. For AI generation, prefer the full JSON document and the correct import path.

HTTPS subscription responses use a separate format-detection flow: complete Xray objects/arrays can be stored as provider configurations, without discarding routing or DNS. Normal pasted node/file import still extracts ordinary nodes.

Contextual JSON hints

The node and Raw editors suggest XDrive service: "google-drive", transport timing, XMUX and template authentication/operations/retry fields; MASQUE XMUX; XDNS resolver TLS/QUIC; TLS ALPN/ECH socket settings; and REALITY mldsa65Verify. Suggestions follow the owning object: transport XMUX is separate from outbound mux, and template hrefPath/hrefMethod belong to operation objects.

HTTP methods are suggestions, not a whitelist. Headers, form data, URLs, JSON paths, template variables and unknown fields remain freely editable. Hints do not rewrite existing service values or nested Maps on save/share. They do not add ordinary-form support for every Core field or establish that a remote service is configured correctly.

Core 26.10.29 JSON assistance

Contextual hints cover FinalMask TCP Fragment/UDP masks, socket tcpKeepAliveIdle/tcpKeepAliveInterval, and Freedom finalRules fields action, network, port, ip, blockDelay. These are editor hints, not added runtime defaults or automatic allow rules. Freedom FinalMask is also available on Freedom helpers in Advanced templates; other helper transport/socket ownership stays restricted.

XDrive S3

Manual node JSON, node JSON editing and complete Raw/provider configurations preserve the native XDrive transport Map. Ordinary subscription and pasted-node parsing still uses libXray’s node projection and does not support XDrive; choose one of the native JSON entry points instead.

S3 uses xdriveSettings.service: s3 with s3.endpoint, region, bucket, pathStyle; the Core uses us-east-1 for an empty region and path-style addressing by default. pathStyle: false uses the bucket’s virtual host. secrets is ordered AccessKeyID, SecretAccessKey, optional SessionToken; remoteFolder is a relative object-key prefix. Copy actual provider values; hints do not create credentials or prove cloud transfer.

App-managed explicit dialing uses the real physical endpoint for bootstrap DNS: an explicit fronting streamSettings.address takes priority, otherwise the S3 endpoint host, including the bucket prefix for virtual-host addressing. IP literals need no domain bootstrap. Port, URL path, TLS SNI, HTTP Host and saved JSON remain unchanged; Raw, provider and Advanced retain their own dialing settings.

Last updated on October 31, 2026

Versions and compatibility Ordinary Custom Routing