On its first connection, Shadowrocket needs permission to add a VPN configuration to iOS. This permission creates a network tunnel managed by the app; it is not a subscription to a connectivity service or a device management profile. Follow these steps if you are authorizing the app for the first time, tapped Don’t Allow, deleted the configuration and can’t connect, or find that it reconnects after you turn it off: verify which app owns the configuration, check On Demand, authorize it again, then test the connection.
Add VPN Configuration: What System Authorization Does
When you turn on the connection switch in Home, Shadowrocket asks iOS to save a VPN configuration. The system prompt confirms a network configuration change on your iPhone or iPad; it is not a prompt to import a subscription. Once you allow it, iOS can use this configuration to start the app’s tunnel extension and route the traffic it handles through Shadowrocket. Depending on your device’s security settings, you may need to enter your passcode or authenticate another way.
Here, VPN refers to the system’s network tunneling mechanism. It does not mean you need to fill in the built-in VPN server form in iOS Settings. Your existing server details, Subscribe subscriptions, and Config rules remain managed in Shadowrocket. The entry in Settings handles connection authorization and status; it does not replace the app’s data.
Authorization only means iOS allows the tunnel to be created. It does not confirm that the server settings are valid or that all traffic will use a proxy. With Config selected under Global Routing, the active rules determine the route. With Direct selected, traffic follows the direct connection policy. The VPN Connected status in iOS alone does not prove that a request went through the selected server.
VPN Entries vs. Device Management Profiles
Open Settings > General > VPN & Device Management, then view the VPN list and find the entry associated with Shadowrocket. The menu name or location may vary between iOS versions; search for “VPN” in Settings if needed. Check the entry’s name and app association. Don’t delete a configuration based on a similar name alone.
People often call this a “VPN profile,” but the VPN configuration is different from any device management profile shown on the same screen. A management profile may include organization controls, certificates, or network restrictions. Authorizing Shadowrocket on first connection does not enroll your device in organization management. When troubleshooting, check only the relevant VPN entry; don’t delete a profile used for work or school.
- System VPN configuration: Stores the information iOS needs to create an app-managed tunnel. You can view its connection status and details in Settings.
- Servers and Subscribe in Home: Store your existing connection details. Deleting the system VPN entry does not remove a subscription.
- Config: Manages rules and related configuration. Reauthorizing the system VPN does not automatically fix rule order or policy selection.
- Device management restrictions: Managed devices may prevent VPN configurations from being added or changed. If you encounter a restriction, contact your device administrator instead of repeatedly deleting entries.
First-Time Authorization and What to Do If You Tapped Don’t Allow
Before you begin, confirm Shadowrocket was obtained from the App Store and that you already have your own server or subscription details. The app purchase and connectivity services are separate: buying the app does not include a service plan. If you tapped Don’t Allow by mistake, return to the app and try connecting again. You usually don’t need to delete the app or erase its data.
-
Verify the app
Use the app verification page to check the developer, Shadow Launch Technology Limited, and app ID id932747118. Shadowrocket is a one-time purchase on the App Store. Check the App Store listing for system requirements.
-
Check your connection details
Open Home and confirm that you have a usable server entry. To use your own subscription, tap “+” in the top-right corner of Home, set Type to Subscribe, enter your subscription URL, and save.
-
Start a connection
Select the server you want to use, then turn on the connection switch in Home. When iOS asks to add a VPN configuration, verify that the request is from Shadowrocket, tap Allow, and complete any required authentication.
-
Check the status
Check the connection status in Home, then verify that the entry was created in the system VPN list. If you tapped Don’t Allow, return to Home and try again. If the prompt still doesn’t appear, check the system list and any device management restrictions.
Delete the Configuration and Authorize Again
You can recreate the system VPN configuration if its status doesn’t match the app, or if you deleted it and need to restore it. Do this only after basic checks: confirm your current network is working, make sure another personal VPN connection isn’t switching, and check Settings → On Demand. Recreating the configuration is not a general fix for every connection problem.
-
Note your settings
Note the server selected in Home, the Global Routing option, and the name of the active configuration in Config. Make sure you can retrieve your own subscription details. Don’t share a full subscription URL or credentials publicly.
-
Pause On Demand
Go to Settings → On Demand and temporarily turn off on-demand connections. Then return to Home and turn off the connection switch. This helps prevent iOS from reconnecting automatically based on existing conditions before you delete the entry.
-
Delete the entry
Go to Settings → General → VPN & Device Management → VPN. Open the details for the entry you confirmed belongs to Shadowrocket, tap Delete VPN, and confirm. Don’t delete entries for other apps or any device management profile.
-
Authorize again
Return to Home in Shadowrocket and turn on the connection switch again. When iOS asks to add a VPN configuration, tap Allow and complete authentication. If no prompt appears, first check whether the corresponding configuration is still in the VPN list.
-
Test the connection
Once the status in Home matches the system VPN status, visit a destination you know and check the app’s connection logs. After the connection is stable, restore Settings → On Demand if needed.
Deleting the system VPN configuration usually does not remove subscriptions in Home or files in Config, but it is not a backup of app data. Don’t uninstall Shadowrocket just to recreate authorization; uninstalling can make data recovery more complicated. If Delete VPN is unavailable or iOS keeps refusing to add the configuration, check whether the device is managed and ask its administrator to review the relevant policy.
Authorized but Can’t Connect? Troubleshoot by Stage
First identify when the problem occurs: before you allow the configuration, while the tunnel is starting, or after the connection is established but a destination remains unreachable. Check system authorization for the first case; investigate the server, DNS, and rules for the latter cases. The English messages below may appear in system connection errors. Use them only if they match the message you actually see. Wording varies with system language and connection type; these are not a definitive list of Shadowrocket errors.
Error: The VPN server did not respond.
Cause: iOS did not receive the expected connection response. The cause may involve your current network, the connection destination, or the VPN configuration in use. This message alone does not mean authorization was lost.
What to do: First identify which VPN entry triggered the error. Then check the address and port of the server selected in Home, along with your current network. Recreate the authorization only if the corresponding system configuration is faulty.
Error: User authentication failed.
Cause: Authentication for the current connection failed. This is a separate step from the device authentication requested when you first add the configuration.
What to do: Identify the connection that reported the error, then check its authentication fields and status against your own service details. Recreating the system VPN entry won’t fix incorrect service credentials.
If Home shows a connection but webpages won’t load, check Global Routing and the active rules in Config. For example, DOMAIN-SUFFIX,example.com,DIRECT routes matching domains through DIRECT; FINAL,PROXY is the fallback for traffic that doesn’t match an earlier rule. Interpret rules in the context of the active configuration; don’t replace the entire configuration just to test a connection.
- The switch turns itself off: Check whether iOS allows the configuration to be saved, whether device management restrictions apply, and whether the app reports a tunnel startup error.
- Can’t reach a destination after connecting: Check the server settings, service status, DNS, and which rules match. Don’t repeat system authorization.
- Reconnects after you turn it off: Check Settings → On Demand first. See whether the reconnection stops when you turn off on-demand connections.
- Problems after switching networks: Record the results on Wi-Fi and cellular separately. Change one condition at a time rather than rebuilding the configuration and changing all your settings at once.
Common Questions About Deleting, Reconnecting, and Switching Devices
I tapped Don’t Allow. Do I need to buy the app again?
No. You don’t need to buy the app again because you declined VPN authorization. The App Store manages your purchase; VPN authorization is managed on each device. Return to Home and try connecting again. If no prompt appears, check the system VPN list and device restrictions before deciding whether to recreate the configuration.
If I delete the VPN configuration, do I need to add my subscription again?
First check for existing entries in Home, then check whether your configuration is still in Config. Deleting only the system VPN entry usually won’t remove this data. If the entry is still there, authorize again without importing the same subscription twice.
Why does it reconnect a while after I turn off the switch?
Go to Settings → On Demand and temporarily turn off on-demand connections, then disconnect in Home and see what happens. On Demand can start a connection when its configured conditions are met. If the app still reconnects, check other VPN entries in Settings and any device management policies.
Do I need to authorize it again on my iPad?
VPN authorization is managed separately on each device. Sign in with the Apple ID used for your purchase, get the app from your App Store purchase history, and check or import your own existing connection details. Then authorize the system configuration the first time you connect on your iPad. Check the App Store listing for compatibility and system requirements.
When contacting support, include the stage when the problem occurs, the exact system message, the connection status in Home, your Global Routing selection, and your current network type. Before sharing connection logs, redact server authentication details, full subscription URLs, and personal network information. Clearly distinguishing “can’t authorize” from “can’t reach a destination after authorization” is more helpful than repeatedly deleting the configuration.