Xray proxy protocols and transports
OneXray is a client built on Xray-core, not a server provider. The server’s protocol and connection parameters determine what you can use; a client cannot turn an arbitrary server into a different protocol.
Identify the parts of a server configuration
| Layer | Examples | What to obtain from the provider |
|---|---|---|
| Proxy protocol | VLESS, VMess, Trojan, Shadowsocks, SOCKS | Address, port and protocol-specific credentials |
| Transport | RAW/TCP, XHTTP, WebSocket, gRPC | Network and any Host, path, mode or service name |
| Connection security | TLS, REALITY | Server name and required certificate/key parameters |
| VLESS flow | Vision | The exact flow, only when the server requires it |
VLESS and REALITY, XHTTP transport and VMessAEAD have dedicated import guides. These are compatible settings only when the provider configures them together, not interchangeable protocol names.
Choose an import format
Use Servers → Add server for supported share links, subscriptions or node files. VMessAEAD/VLESS links follow the Xray share-link specification; SS, SOCKS and Trojan links are also supported. Legacy VMessQrCode, Clash/Mihomo configurations and Hysteria2 URIs are not supported import formats.
For AI-generated nodes, use a JSON object containing outbounds, as defined in the outbound contract. Full JSON can preserve settings a share link cannot represent. Routing and complete Raw configurations have separate import entries.
Shadowsocks
Obtain the server address, port, exact encryption method and password/key. Import an ss:// link or a native Shadowsocks outbound JSON. Do not guess a cipher or key length; a recognizable link can still contain settings the bundled Core rejects.
Trojan
Obtain the address, port, password, transport and TLS parameters. Import a trojan:// link or native outbound JSON. Keep the provider’s server name and certificate checks; turning off verification is not a repair for mismatched settings.
SOCKS
Obtain the address, port and optional username/password. Import a socks:// link or a SOCKS outbound JSON. SOCKS is not encrypted by itself, so consider the trust and reachability of the network carrying that connection.
Check the result
After import, find the server name and protocol/transport labels in Servers. A successful import is not a live connectivity test. Select the node on Connect, finish the platform’s VPN Tunnel prerequisites, then test your intended destination.
If import fails, check the format and compatibility; if connection fails, check the provider’s values, network reachability and DNS. Do not post subscription tokens or credentials in public reports.