A subscription is a remote source of server configurations. It is not an in-app purchase or a VPN service supplied by OneXray.

Add, edit, and update

Enter a name and HTTPS URL, panel (Generic or Remnawave), configuration mode, and optional age/HWID settings. A new source can choose its mode from the first response; existing sources retain their saved mode unless changed explicitly. Old subscriptions start as Generic/App-managed.

After optional age decryption, ordinary share links and Generic outbounds-only JSON use node parsing. Complete Xray objects or nonempty arrays use the provider path; for the Remnawave panel, even outbounds-only JSON follows this path. Invalid full configurations are skipped individually. Usable entries for the current mode are committed together; no usable entries, download failures or validation-service errors retain the old caches and update time. Sing-box JSON is not supported.

The complete and independently usable outbound caches belong to one source. Switching modes uses local caches without downloading, reconnecting or resetting App routing preferences. Missing current-mode data offers refresh. A fixed incompatible selection requires reselection. Current, selected and favorite assets retain the normal refresh protection; a running VPN is not hot-replaced.

Editing saves the source, panel/mode, User-Agent, age and HWID fields, without refreshing. Use Check for updates to download. Automatic updates apply to all sources. Full import/runtime boundaries: Remnawave configurations.

Download User-Agent

Each source has User-Agent (optional). The form starts with the compatible default v2rayN/<OneXray version> <full OneXray User-Agent>; enter a single line of ASCII text if the provider requires another value. A custom value applies only to this subscription. Clearing it uses the same default, regardless of panel; switching panels keeps the field. Downloads use your HTTPS URL as entered, without adding a format endpoint.

For an existing source with no saved UA, editing displays the default without saving it automatically. Saving a UA change takes effect on the next refresh and clears cached plan information. Explicit UA values are preserved in OneXray subscription links and connection backups.

Subscription plan information

When a successful subscription download includes a Subscription-Userinfo header, OneXray shows the provider’s available usage, quota, remaining traffic, and expiry information. Usage is upload plus download; remaining traffic requires both usage and a quota. Zero total means unlimited traffic; zero expiry means no expiration. Missing fields are not interpreted as unlimited.

These are provider-reported figures, not real-time connection statistics. They refresh with the subscription, without a separate polling request. Failed updates retain the old figures; a successful response without the header clears stale data. Changing the source or its authentication settings clears source-specific information, while renaming does not. An expired or exhausted plan warns the user but does not disable the VPN automatically. Contact the provider about incorrect values or unavailable service.

Optional device identifier (HWID)

Send device identifier (HWID) is off by default; enable it only if your provider requires it. The app creates an independent random identifier for each subscription and sends it in the x-hwid request header. It does not read hardware serial numbers, advertising IDs, or system device identifiers. HWID applies to that subscription’s download, not the VPN configuration.

Once created, the identifier stays the same across toggles, renaming, URL edits, restarts, and upgrades. Changing the URL scheme, host, or port turns sending off; explicitly enabling it again sends the original identifier. Deleting and recreating a subscription or clearing data creates a new identifier and may use another provider device slot.

Same-origin HTTPS redirects retain HWID; cross-origin redirects remove it, even if a later redirect returns to the original origin. To send to a new origin, configure its URL directly and explicitly enable the switch. Provider verification, device-limit, and registration failures show a specific cause without replacing old nodes with empty content or placeholder nodes.

Turning the switch off or deleting the local subscription does not remove the provider’s device record; manage that with the provider. HWID can be combined with age, and shared links omit both the identifier and its switch.

age encryption

Only enable age if the source supports it. You can enter an existing public/private key pair or generate:

• X25519
• Hybrid ML-KEM-768 + X25519

Both key fields must be filled together or left empty. Generating replacements asks for confirmation.

The app sends the public key in the X-Age-Public-Key request header and decrypts the response locally using the private key. The pair is reused for later updates. Decrypted subscription text is limited to 16 MiB.

age protects the response payload; it does not replace HTTPS or make an untrusted source trustworthy. Failed decryption never replaces valid existing nodes with an empty list.

Sharing

An age subscription link includes the algorithm, not your existing keys. The receiving device generates its own pair; the source must support responding to its new public key.

URLs can contain access tokens. Check the content before sharing. Sharing formats.