This guide covers system VPN authorization for Shadowrocket on iPhone and iPad: why you need to allow it the first time, how the system VPN entry differs from Config in the app, and how to recover after denying permission or deleting the entry. First confirm authorization, then check whether the connection is established. A connected status in Settings does not guarantee that the proxy server is reachable or that every website will load.
Why authorization is required the first time
When you turn on the connection switch in Home, Shadowrocket uses the system’s network extension to create a VPN tunnel. The app can request permission to add a configuration, but only you can approve it in the system prompt. That’s why the “Add VPN Configurations” prompt appears the first time you connect. It’s an authorization request, not a subscription update or a request to buy the app again.
The VPN configuration lets the system identify and manage the app’s tunnel connection. Once you allow it, a corresponding VPN entry appears in Settings, and later connections usually reuse that entry. This is not the same as installing a provider’s subscription URL as a system profile, nor does it mean all traffic will necessarily go through a remote proxy. Routing depends on Global Routing and the rules currently in effect.
Authorization allows the app to use the system VPN capability to handle network traffic. Approve the request only after you’ve started the connection yourself and confirmed the app’s source. If the prompt appears unexpectedly, cancel it and verify what’s happening in the app. This guide assumes you already have your own provider and subscription; it does not cover obtaining a connection service.
How to approve the first request
These steps apply to iPhone and iPad. System prompts and button labels vary depending on your device language, and authentication depends on your security settings. Don’t confuse your device passcode prompt with subscription account verification, and never enter your device passcode on another website to authorize this connection.
-
Check the connection details
Open Shadowrocket → Home, confirm that you’ve imported your own connection details, and select the server you want to use. If you haven’t prepared connection details yet, there’s no need to keep repeating the steps just to dismiss the prompt.
-
Start the connection
Turn on the connection switch in Home and wait for the system confirmation to add a VPN configuration. Start the connection from within the app; don’t manually create a different type of configuration on the system VPN page as a substitute.
-
Approve the request
Check that the app named in the prompt is Shadowrocket, then tap “Allow.” If the system asks you to authenticate, follow the instructions shown on your device. Canceling authentication prevents the configuration from being added.
-
Check the status
Return to Home to check the connection status, then go to Settings → General → VPN & Device Management → VPN to check the entry. Menu layouts vary by system version; you can also search for VPN at the top of Settings and open the relevant page.
The system VPN page lets you check the entry and connection status; it doesn’t test your provider’s server for you. If the entry exists but websites still won’t load, troubleshoot server connectivity, Global Routing, DNS, and rules instead of repeatedly approving the request.
What each type of configuration stores
People may use “VPN profile” to refer to different things. The most commonly confused items are the system VPN entry, Config in Shadowrocket, and device management or configuration profiles in VPN & Device Management. They may appear in nearby places, but they store different information and have different consequences when deleted.
| Item | Where to find it | Purpose and what happens if you delete it |
|---|---|---|
| System VPN entry | Settings → General → VPN & Device Management → VPN | Manages the app’s system tunnel connection. If you delete it, Shadowrocket may need to add it again and request authorization the next time you connect. |
| Config in the app | Shadowrocket → Config | Stores settings such as rules and DNS. Choosing a different Config affects how requests are handled, but does not replace system VPN authorization. |
| Servers and subscriptions | Shadowrocket → Home | Store connection details or imported subscription data. Deleting only the system VPN entry usually does not clear this data from the app. |
| Device management profile | Settings → General → VPN & Device Management | May be installed by an organization to apply management policies, certificates, or network settings. Don’t delete it casually as if it were Shadowrocket’s authorization entry. |
Before deleting anything, identify what it is
Only request VPN authorization again if the system VPN entry is missing. If Config is incorrect, check Config instead; deleting a device management profile won’t fix app rules.
Most people don’t need to find and install a separate system profile to authorize Shadowrocket. Organization-managed devices may have additional restrictions; whether VPN configurations can be added depends on the management policy. Check with your device administrator rather than trying to bypass the restriction.
How to recover after denying permission or deleting the entry
If you tapped “Don’t Allow,” the system configuration wasn’t added that time. This does not mean your in-app subscription has expired. Return to Home, turn the connection switch off, then turn it on again and check whether the system prompts you to authorize the request. If no prompt appears, check the system VPN list first to see whether a Shadowrocket entry already exists, rather than assuming it can’t be added.
- Just denied the request: Return to Shadowrocket → Home and start the connection again. When the system confirmation appears, tap Allow and complete any required authentication.
- Deleted the system entry by mistake: Keep your in-app data. Reconnect from Home to let the app recreate the system VPN configuration; you don’t need to delete the app or reimport your subscription right away.
- Canceled authentication: Start the connection again and complete device authentication. The confirmation prompt disappearing does not mean authorization succeeded; check the VPN entry and connection status.
- The switch turns itself off: First confirm that authorization is complete. Then check whether another VPN is still connected and whether your device is subject to organization management restrictions.
- No prompt appears after repeated attempts: Disconnect other active VPNs, quit and reopen Shadowrocket, then try again. If needed, restart your device and check the system VPN page.
Only rebuild the system entry if you’ve confirmed that’s necessary. Disconnect first, then find the Shadowrocket configuration in the system VPN list and delete it from its details page. Return to Home and authorize it again. Confirm the entry name before deleting anything, and don’t remove other VPN or management configurations needed for a work device. Reinstalling the app should not be your first step, as it may remove local settings that haven’t been backed up.
System prompt: “Would Like to Add VPN Configurations”
What it means and what to do: This is the confirmation text shown by the English-language system when adding a VPN configuration, not a server error. It appears when the app requests a system VPN entry. Confirm that the request came from Shadowrocket, which you’re currently using, then tap Allow and follow the system’s authentication steps. The prompt appears in the corresponding language on devices set to another language.
Why does it reconnect after I turn it off?
If the system VPN switch turns back on after you turn it off, On Demand may be triggering the connection. On Demand connects when preset conditions are met; it’s separate from manually tapping the Home switch and doesn’t mean deleting the system VPN entry failed. To troubleshoot, first pause the automatic connection conditions, then check whether a manual connection works.
- Open Shadowrocket → Settings → On Demand and check whether On Demand and its conditions are enabled. Temporarily disable the relevant options while troubleshooting.
- Return to Home and turn off the connection. Check whether the VPN page in Settings stays disconnected. If it reconnects, check whether a different VPN entry is establishing the connection.
- If the system VPN entry details show Connect On Demand, check that setting too. Organization-managed settings may not be editable by the user.
- After authorization or connectivity testing, turn On Demand back on if needed. Test how it behaves when switching between Wi-Fi and cellular data.
Disable automatic connection conditions before deleting an entry to avoid mistaking an On Demand connection for a problem. If your device is managed by a school or employer, uneditable settings or entries that reappear may be due to management policies. Keep screenshots of the relevant settings and ask your administrator to check them; don’t repeatedly remove profiles.
Authorized, but can’t access the internet
Successfully adding a VPN configuration only means the system allows the app to create a tunnel. The remote server address, port, authentication details, DNS, or rules may still be incorrect. Change one setting at a time and retest using the same address so you can tell which change made a difference.
| What you see | Check first | Next step |
|---|---|---|
| No VPN entry; connection won’t stay on | System authorization and device management restrictions | Reconnect from Home and approve the request, completing authentication if prompted. |
| VPN connected, but server test fails | The selected server in Home and its connection details | Check the address, port, and authentication details against information from your provider. Don’t change the port at random to fix an authorization issue. |
| VPN connected, but traffic still goes direct | Home → Global Routing | Check whether Direct is selected. Config applies the configured rules, Proxy routes traffic through a proxy, and Scene applies settings for the selected scenario. |
| Some domains won’t load, but other sites work | DNS and rules in the current Config | Check the request log for DNS results, matching rules, and the final policy. |
When Config is selected under Global Routing, rules are matched in order. Check entries such as DOMAIN-SUFFIX, IP-CIDR, and GEOIP, then check which policy the final FINAL rule points to. VPN authorization doesn’t fix rule order or change FINAL,DIRECT to a proxy policy. See the configuration field reference for details; you don’t need to authorize the VPN again to change rules.
Common VPN authorization questions
Does allowing the VPN configuration route every request through a proxy?
No. Allowing the request enables the system VPN configuration. Actual routing depends on Home → Global Routing and the current configuration. Check the selected mode, then review the matching rules in the request log; don’t rely only on the VPN indicator in the status bar to determine where traffic is routed.
Will deleting the VPN entry also delete my subscription?
Deleting only the system VPN entry usually won’t clear subscriptions or servers in Home, and it won’t reset Config. After deleting it, reconnect from Home. If an in-app item is actually missing, restore it using the subscription information you saved yourself.
Why am I asked to add the configuration every time I connect?
First confirm that you tapped Allow and completed authentication the last time. Then check whether the entry remains on the system VPN page. If it keeps disappearing, check for device management restrictions or manual cleanup, and note the steps that lead to the issue. Don’t keep reinstalling the app.
Do I need to install a certificate separately after allowing the request?
This step doesn’t require installing a root certificate for a standard proxy connection. VPN authorization and certificate settings for HTTPS decryption are separate. Don’t install a certificate from an unknown source just to dismiss the VPN configuration prompt.
Do the same steps apply to Mac and other platforms?
The system settings path in this guide is for iPhone and iPad. Mac, Windows, Android, and Linux have different permission prompts and network management interfaces. Choose your platform on the download page on this site, then follow the prompts from that system; don’t copy the iPhone menu path.