Xray proxy protocols and transports
OneXray is a client built on Xray-core, not a server provider. The server’s protocol and connection parameters determine what you can use; a client cannot turn an arbitrary server into a different protocol.
Identify the parts of a server configuration
| Layer | Examples | What to obtain from the provider |
|---|---|---|
| Proxy protocol | VLESS, VMess, Trojan, Shadowsocks, SOCKS | Address, port and protocol-specific credentials |
| Transport | RAW/TCP, XHTTP, WebSocket, gRPC | Network and any Host, path, mode or service name |
| Connection security | TLS, REALITY | Server name and required certificate/key parameters |
| VLESS flow | Vision | The exact flow, only when the server requires it |
VLESS and REALITY, XHTTP transport and VMessAEAD have dedicated import guides. These are compatible settings only when the provider configures them together, not interchangeable protocol names.
Choose an import format
Use Servers → Add server for supported share links, subscriptions or node files. VMessAEAD/VLESS links follow the Xray share-link specification; Hysteria2, SS, SOCKS and Trojan links are also supported. Legacy VMessQrCode and Clash/Mihomo configurations are not supported import formats.
For AI-generated nodes, use a JSON object containing outbounds, as defined in the outbound contract. Full JSON can preserve settings a share link cannot represent. Routing and complete Raw configurations have separate import entries.
Hysteria2
Import hysteria2:// or hy2:// links with authentication, SNI, Salamander obfuscation and optional port hopping. Omitted ports use 443; exported links use hysteria2://. Multiple ports/ranges in the authority and legacy ports / mport queries are accepted. The default hopping interval is 30 seconds; hop-interval must be at least 5 seconds.
TLS verification is required. Links requesting insecure=true, allowInsecure=true or pinSHA256 are rejected because the bundled Core cannot preserve those certificate-verification semantics. Explicit Xray extensions such as pcs / vcn retain Xray semantics, not Hysteria’s pin semantics. Realm and Gecko are not supported. Port hopping requires direct UDP sockets and is not supported over chained proxies. Client-local QUIC bandwidth/tuning is not included when exporting a standard share link; use full outbound JSON to preserve it.
Shadowsocks
Obtain the server address, port, exact encryption method and password/key. Import an ss:// link or a native Shadowsocks outbound JSON. Do not guess a cipher or key length; a recognizable link can still contain settings the bundled Core rejects.
Trojan
Obtain the address, port, password, transport and TLS parameters. Import a trojan:// link or native outbound JSON. Keep the provider’s server name and certificate checks; turning off verification is not a repair for mismatched settings.
SOCKS
Obtain the address, port and optional username/password. Import a socks:// link or a SOCKS outbound JSON. SOCKS is not encrypted by itself, so consider the trust and reachability of the network carrying that connection.
Check the result
After import, find the server name and protocol/transport labels in Servers. A successful import is not a live connectivity test. Select the node on Connect, finish the platform’s VPN Tunnel prerequisites, then test your intended destination.
If import fails, check the format and compatibility; if connection fails, check the provider’s values, network reachability and DNS. Do not post subscription tokens or credentials in public reports.