App Store purchase · One-time payment
The official guide for iPhone / iPad: from importing an existing subscription to rule-based routing, with a one-time purchase for the app.
Get Started
Shadowrocket is sold exclusively through the App Store. On the product page, first verify the developer, official app icon, and app ID, then check the current store's price and device compatibility. If you already bought the app, check your purchase history before deciding what to do next.
Buy and install the app through the App Store. The first time you connect, review the VPN configuration request and grant permission when prompted. Once the connection indicator appears, also check that your destination is reachable and traffic is being routed as expected.
View the iPhone setup guide →Use the same Apple ID to check your purchase history. You may be able to get the app on a compatible iPad. The app purchase and your local configuration are separate: after installation, check your server, active Config, and permissions. See the App Store listing for purchase eligibility.
View the iPad setup guide →Shadowrocket is also available from the same App Store on Mac and Apple TV. Check the App Store listing for system requirements and purchase eligibility.
Settings and How They Work
First, distinguish server settings, configuration files, and routing choices. The server determines how a connection is established; Config stores settings such as rules; Global Routing determines how the current connection is handled. Check each separately when troubleshooting instead of attributing one failure to every setting.
In Home, select Config under Global Routing to route connections according to the rules in the active configuration. Domains, domain suffixes, and IP ranges use different rule types, and rule order affects which one matches. Start with specific matches, then check how FINAL handles the rest. PROXY, DIRECT, and REJECT specify different actions; they are not server names. Check the request's match record to verify the result. An enabled connection switch alone does not confirm that a rule is working.
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXYOn Demand can initiate a connection when specified conditions are met; find it in Settings. First make sure a manual connection works, then check that the trigger conditions match your current network. On Demand cannot fix incorrect server settings, and it does not mean every request will use PROXY. If you need to stop the connection temporarily, also check related trigger settings to prevent it from reconnecting. For troubleshooting, pause On Demand and test manually on the same network. Once the basic connection is stable, restore the conditions you need one at a time.
Settings
On Demand
Global Routing: ConfigIn Add Server, choose a Type that matches your existing server's protocol, then enter the corresponding fields. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different parameter formats; changing only Host while keeping settings from another protocol will not work. Check the port, authentication, transport, and TLS details against the information from your provider. With WireGuard, distinguish the local private key from the peer's public key. A successful import only means the details were recognized; connection success still depends on complete settings and the server's current status.
Add Server
Type
Host
PortImporting requires an existing subscription or server details of your own. First identify whether the link contains a server list or a configuration file, then use the appropriate Subscribe or import option. A configuration file URL in Config is not the same as a server subscription. After an update, check the number of entries, groups, and current selection; repeatedly importing the same link is not a substitute for updating it. Subscription URLs may contain personal access credentials, so hide the full address before sharing a support request or screen. This guide covers importing and checking existing details.
Subscribe
Add Server
Scan QR CodeUse Config to save and select configuration files. Check Rule, Hosts, and other settings in the currently active file. Before editing, keep a recoverable copy and note the existing routing choice; after editing, verify actual requests again. If you use iCloud sync, check that both devices are signed in to the same account, sync is enabled, and the target file has appeared. Sync is not a complete backup. If the server connects but routing is wrong, first confirm which Config is active so you do not keep editing an inactive file.
[General]
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTUse Connectivity Test to check basic reachability, then narrow down the issue with Diagnostics in Settings and the connection logs. Traffic readings in Data can help show whether data is being transferred, but they cannot prove on their own that a website was routed as expected. Before testing, note the selected server, Global Routing setting, and current network; change only one condition at a time. If the test succeeds but the destination does not load, check DNS, rule matches, and the remote service. Hide credentials and authentication details in any shared logs.
Connectivity Test
Settings → Diagnostics
DataFirst Connection: Step by Step
These three steps are for users who already have subscription or server details. First establish a connection you can reliably test, then add rules, sync, or automatic triggers. Record the result at each step so you can return to the last confirmed working state if something goes wrong.
Config determines how traffic is handled according to its rules. Proxy routes traffic that needs proxy handling through a proxy path; Direct uses a direct path. These choices describe how connections are handled, not whether a server is valid. Questions about Shadowrocket's global mode usually refer to the Global Routing selection. Before changing it, clarify whether you are testing the server or the rules.
If the first test fails, do not change the server, edit DNS, and rewrite Rule all at once. First confirm that the device's network works, then check server settings and authentication, and finally use the match records to troubleshoot rules. The system VPN indicator reflects the configuration's connection status, not whether every destination is reachable. One successful test also does not mean other domains will take the same route.
Verify the App Store Listing and Understand What You’re Buying
Shadowrocket Subscription Guide is the official Shadowrocket guide and manual. Use the App Store product page to buy and install the app, and follow the interface as it appears in the app. Verify all three details rather than relying on a name in search results alone.
On the product page, check that the developer is Shadow Launch Technology Limited, then compare the app icon with the official icon in this site's header. Next, verify that the product link contains app ID 932747118. Similar names in search results are no substitute for these checks. If any detail does not match, return to the verification page; do not rely on the icon color or name alone.
Shadowrocket is a closed-source commercial app. Verify product details, purchase information, and compatibility on the App Store page. Rule snippets on this site explain configuration syntax; they are not a complete, ready-to-use personal configuration.
App Store search results depend on the storefront used by your Apple ID. Your device's location and interface language do not directly determine your account's storefront region. If you cannot find the app, first check the current storefront, then open the product page to see its specific message. Check storefront availability, account status, and device compatibility separately; no search results alone does not mean the app's identity has changed.
If the product page says your device is incompatible, check the requirements in the compatibility section, then check your device's system. Always refer to the App Store listing for system requirements. For the steps to verify the storefront and account, see the App Store purchase guide.
The US storefront lists a one-time price of $2.99; other storefronts show local currency. The final price is the one displayed on the App Store page. You can get the app on iPhone and iPad from the purchase history for the same Apple ID, subject to device compatibility and purchase eligibility as shown on the App Store page. Check your purchase history to confirm whether you already own it rather than relying on whether an app icon is on your device.
The same purchase record does not mean local configurations on both devices will automatically match. After installation, check your server details, selected Config, and connection permission. If you use sync, make sure the required file has reached the target device before testing the connection.
When changing devices or reinstalling, sign in with the Apple ID used for the original purchase, then find Shadowrocket in the App Store purchase history. If it asks you to pay, first check the account, purchase history, and App Store message to avoid repeating the purchase. Restore the app and restore your configuration separately: purchase history lets you retrieve the app, while server details and personal rules must be restored from records you have saved and trust.
Update the app through the App Store, where you can check release notes and automatic update settings. Family Sharing eligibility and terms are determined by the App Store listing; another family member's purchase does not automatically count as a purchase on your account.
Separate issues by their cause to make troubleshooting clearer: for purchase and restore problems, check your App Store account and purchase history; for failed subscription updates, check the existing link and service status; if a connection works but routing does not, check Global Routing and the active Rule. Note your original settings before making changes, then retest the same destination to identify what made a difference.
Server lists and configuration files serve different purposes. A subscription updates server details, while the active Config determines settings such as rules. Even if both are saved successfully, you still need to check the selected server and Global Routing. Compare the meanings of Subscribe, Config, and Rule in the Glossary, then check each item using the guide.
Not necessarily. The test only shows connectivity under the conditions tested. Visit the destination you want to check, review the actual rule match and action, and see whether Data shows the expected traffic. If the result is wrong, first check the active configuration and rule order instead of rewriting all your server details.
First check On Demand and its trigger conditions in Settings, then look at the system VPN status. To narrow down the cause, temporarily disable automatic triggers and test a manual connection. Once the basic connection works, restore the conditions you need. For explanations of interface terms, see the Glossary.
Keep the error message, protocol type, Global Routing setting, test destination, and steps you took. These details are usually more useful than simply saying “it won't connect.” Before sharing, hide the full subscription URL, authentication parameters, and keys. Share only the field names and symptoms needed to diagnose the issue, never personal connection credentials.
Featured Guides
After your first connection, choose a guide based on the issue you need to solve. Traffic statistics help you monitor data transfer; managing multiple subscriptions helps organize sources; protocol guides explain how to check fields. Each guide focuses on one type of problem, so you can avoid changing unrelated settings at the same time.
Explains the readings in both views, the statistics period, and how to reset the counters. Use connection logs to understand traffic changes, and distinguish data transfer from traffic being handled by the expected rules. Do not infer routing results from the total alone.
Read the guide →For users who already have multiple saved subscriptions, this guide explains how to identify sources, organize groups, and decide what to keep before deleting anything. First determine whether entries are duplicate imports or the result of an update, then choose the right way to clean them up.
Read the guide →Explains each parameter and where to find it, including the difference between the local private key and peer public key, and how to check the address, DNS, and MTU against the details you already have. If something fails, check each field instead of blindly replacing the entire configuration.
Read the guide →Rule Matching Example
This syntax example illustrates rule structure; it is not a complete connection configuration. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP ranges, and FINAL handles connections that have not matched earlier rules. Before using rules, check their actions against your server selection and access needs.
When two rules could match the same destination, their order affects the result. Check the more specific match first, then review the final rule behavior. After making changes, test again using actual request records. example.com is only a sample domain, not a server or subscription link.
Continue to the rule and verification steps →[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD,example,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXY