Skip to content
Documentation
Protocols and transports
VLESS and REALITY

VLESS client setup: TLS, REALITY and Vision

VLESS is a proxy protocol supported by OneXray’s Xray-core. REALITY is a connection-security option and Vision is a VLESS flow: they are not separate server protocols. Use the combination your provider supplies.

Prepare the server details

You need the address, port, user ID, encryption value and transport. With TLS, confirm the server name and any required fingerprint or ALPN. With REALITY, also obtain the public key/password and short ID. The connection address and TLS server name need not be identical.

Use a flow such as xtls-rprx-vision only if required by the provider and compatible with its transport. Do not add Vision to an arbitrary XHTTP configuration. The XHTTP guide explains the transport-specific parameters.

Import a link or JSON

  1. Install OneXray, then open Servers → Add server.
  2. Import the provider’s vless:// link, subscription or node JSON file. QR scanning is available on iOS and Android.
  3. For manual JSON, use an outbounds array with exactly one node. Fill in all provider values before saving.
  4. Check the node’s name and labels, select it on Connect, and use Smart Routing unless you need custom rules.

The existing TLS template uses reserved example values, not a working server:

JSON: outbound-vless-tls.json

{
  "outbounds": [
    {
      "tag": "My VLESS server",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "server.example.com",
            "port": 443,
            "users": [
              {
                "id": "00000000-0000-4000-8000-000000000001",
                "encryption": "none"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "raw",
        "security": "tls",
        "tlsSettings": {
          "serverName": "server.example.com"
        }
      }
    }
  ]
}

For REALITY, replace the unresolved public-key placeholder and other provider values:

JSON: outbound-vless-reality.json

{
  "outbounds": [
    {
      "tag": "My REALITY server",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "server.example.com",
            "port": 443,
            "users": [
              {
                "id": "00000000-0000-4000-8000-000000000001",
                "encryption": "none"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "raw",
        "security": "reality",
        "realitySettings": {
          "serverName": "cover.example.com",
          "fingerprint": "chrome",
          "password": "REPLACE_WITH_REALITY_PUBLIC_KEY",
          "shortId": "0123456789abcdef"
        }
      }
    }
  ]
}

In this JSON, realitySettings.password carries the server’s public key, not its private key. See the outbound contract for field ownership and naming.

Diagnose a failed connection

An import or configuration check does not prove that the server is reachable. Check the ID, port, flow, transport, server name, public key and short ID against the provider’s original configuration. A REALITY key from a different server will not become valid by renaming the node.

Do not disable TLS verification to suppress a certificate error. If the node works but only some domains fail, inspect routing and DNS instead of changing protocol fields at random. Troubleshooting separates import, validation, startup and connectivity failures.

Reference: Xray VLESS outbound.

Last updated on
XHTTP transport