The “Add VPN Configurations” prompt is an Apple system authorization step that appears when you connect with Shadowrocket for the first time—not a connection error. This guide is for iPhone and iPad. It explains the difference between the system VPN configuration and in-app Config, how to authorize and check the system status, and how to trigger the prompt again if you declined or deleted the configuration. It assumes you already have your own service provider and subscription; authorization does not provide a connection service.
1. Why a VPN Configuration Is Needed the First Time You Connect
Shadowrocket uses the system’s network extension to establish a VPN tunnel and handle traffic according to your in-app settings. The first time the app asks to save a VPN configuration to the system, iOS asks you to confirm. This prompt allows the configuration to be created; it does not purchase service from a provider or request separate authorization for each in-app rule.
Check for the prompt after you turn on the connection switch in Shadowrocket. Make sure the app name matches what you’re doing, then tap Allow. If iOS asks you to authenticate your device, follow the on-screen instructions. Device authentication is part of the system authorization process; you don’t need to give your device passcode to a service provider or enter it in subscription settings.
Allowing the configuration to be added completes only one step. The connection can still fail because of server settings, network conditions, or configuration content. Verify authorization and access to your destination separately; a dismissed prompt alone doesn’t mean the connection is working.
2. System VPN Configuration, Config, and Subscription: What’s the Difference?
“VPN profile” usually refers here to the VPN configuration created by an app and listed in system Settings. It is different from a configuration profile installed through device management and from the rule file on the in-app Config screen. Seeing these items in nearby system menus doesn’t mean you need to install an additional device management profile.
| Item | Where to check | Purpose |
|---|---|---|
| System VPN configuration | VPN list in system Settings | Lets the system save the app’s VPN connection configuration and show its connection status. |
| In-app Config | Shadowrocket → Config | Stores routing rules and related settings for use with the relevant routing mode. |
| Existing subscription | Shadowrocket → Home | Imports and updates server connection entries you already have. |
For example, in-app Config can contain rule keywords such as DOMAIN-SUFFIX, IP-CIDR, GEOIP, and FINAL. These rules determine how matched requests are handled; they are not types of permission requested by the system prompt. Deleting the system VPN configuration usually does not also delete existing entries in Home or Config files, but keep a copy of your configuration details before making changes.
3. First-Time Authorization and System Settings Checks
These steps use iPhone and iPad as examples. Menu labels vary with the system language, and their locations can change between system versions. On a Chinese-language device, the path is usually Settings → General → VPN & Device Management → VPN. On an English-language device, go to Settings → General → VPN & Device Management → VPN. If you can’t find the menu, search for VPN in system Settings.
-
Check the app
Make sure you’re using Shadowrocket from the App Store. The developer is Shadow Launch Technology Limited, and the app ID is 932747118. See the App Store page for system requirements, compatibility, and purchase availability.
-
Check your existing configuration
In Shadowrocket → Home, check the connection entries you’ve imported and make sure they contain all the required details. System authorization won’t fill in a server address, port, or authentication details for you.
-
Turn on the connection
Turn on the connection switch in Home and wait for the system prompt to add a VPN configuration. Check the app name shown in the prompt, tap Allow, and complete device authentication if requested.
-
Check the system status
Go to system Settings → General → VPN & Device Management → VPN, find the entry for Shadowrocket, and check its status. Seeing the entry means the configuration was saved; check separately whether it is currently connected.
-
Verify access
Return to the app and check the connection switch, then try accessing the destination you need. If the tunnel is connected but access fails, check your server settings, Global Routing, and Config instead of repeatedly adding the system configuration.
Follow the troubleshooting sequenceFirst check whether the system configuration can be saved, then whether the tunnel stays connected, and finally how a specific request is routed. Checking these three layers in order helps prevent mistaking a rule issue for a permissions issue.
4. How to Add the Configuration Again After Declining or Deleting It
If you tapped Don’t Allow the first time, the app couldn’t add the system VPN configuration. You usually don’t need to buy the app again or delete your subscription first. Return to Shadowrocket, make sure there isn’t a connection attempt still in progress, then turn on the connection switch again to prompt the app to create the VPN configuration.
If you deleted the Shadowrocket entry from the system VPN list, follow the same steps: return to the app, check your existing content, and turn on the connection switch. Confirm the prompt if it appears again. If it doesn’t, first check the system list to see whether the configuration is still there. No prompt doesn’t automatically mean something is wrong.
- Configuration already exists: The system can keep using a saved configuration without asking you to authorize it every time you connect. Check the entry name and actual connection status.
- Repeated prompts to add a configuration: Check whether you cancel before the final confirmation each time and whether device authentication is complete. If the configuration still isn’t saved, troubleshoot system authorization first.
- Before rebuilding the configuration: Turn off the app connection. If On Demand is enabled, first disable the relevant setting in
Shadowrocket → Settings → On Demand, then manage the system VPN entry. - Managed device: Devices managed by a school or workplace may restrict VPN configuration changes. Check whether the system shows a management restriction and ask the device administrator to review the policy. Don’t delete management items unless you know what they’re for.
Consider disconnecting, deleting the entry, and rebuilding it only if you’ve confirmed that it’s faulty and a normal reconnect hasn’t fixed the issue. Don’t clear the entire VPN list or remove profiles used for work, school, or other purposes. Reinstalling the app risks losing local content and shouldn’t be your first step when troubleshooting authorization.
5. How the Connection Switch, System Status, and On Demand Work Together
The connection switch in Home starts or stops the connection; the system VPN screen shows the tunnel status reported by the system. A configuration can remain saved while the connection is disconnected, so seeing Shadowrocket in the list doesn’t mean there’s an active background connection. Check the status, not just whether the entry exists.
On Demand asks the system to connect when its configured conditions are met. If the connection comes back after you disconnect manually, check Settings → On Demand first instead of assuming the disconnect didn’t work. To test a manual connection on its own, disable the relevant On Demand setting, disconnect, reconnect, and see whether the behavior changes.
| What you see | What it means | Next step |
|---|---|---|
| Configuration present, not connected | The system has saved the configuration, but the tunnel isn’t currently established. | Return to Home, connect manually, and watch for a status change. |
| Connected, but access is failing | The system tunnel is established, but access to your destination still needs to be checked. | Check the current entry, Global Routing, Config, and the destination network. |
| Connects again after disconnecting | An On Demand condition may have triggered another connection. | Disable the relevant On Demand setting and repeat the manual test. |
| Disconnects immediately after connecting | The configuration, network, or server may be preventing the session from staying connected. | Note where the failure occurs, then check your existing server settings and network reachability. |
Global Routing and system authorization are separate. Proxy, Direct, Config, and Scene are in-app routing options, not four types of system VPN permission. In particular, selecting Direct does not mean the VPN has been disconnected. To stop the tunnel, use the connection switch and check the system status.
6. Tell Authorization Prompts Apart from Connection Errors
When troubleshooting, note the exact text on screen and when it appears. The English messages below are prompts or statuses shown on an English-language system; other system languages display localized versions. Neither is necessarily an error: the first is an authorization request, while the second is a connection status. Recording the text without noting where it appeared can lead to the wrong conclusion.
System prompt: “Shadowrocket” Would Like to Add VPN Configurations
What it means and what to do: The app is asking to save a system VPN configuration. If this appears right after you turn on the connection switch, verify the app name, tap Allow, and complete device authentication if requested. Until you confirm, don’t treat it as a server connection error.
System status: Not Connected
What it means and what to do: The VPN is not currently connected. Return to Home, turn on the connection switch, and see whether it stays connected. If it immediately returns to this status, check the specific error shown in the app and your existing server settings rather than repeating system authorization.
If the system VPN configuration already exists but the app keeps asking to create one, fully stop the current connection attempt and check that the system entry actually belongs to the app you’re using. For further troubleshooting, note the sequence—turning on the switch, seeing the prompt, confirming, and disconnecting—and whether you were on Wi-Fi or cellular. Before sharing screenshots, hide subscription URLs, authentication details, and sensitive server fields.
7. First-Time Connection FAQs
Does allowing the configuration send all requests through a proxy?
No. Allowing the configuration grants permission to create the system configuration. How each request is handled depends on Global Routing and the current configuration. To route traffic by rules, check Config in Global Routing and the rule file that’s actually enabled. Don’t infer how each request is routed from the VPN indicator alone.
Will deleting the VPN configuration also delete my subscription?
Deleting the system VPN entry and deleting a subscription in Home are separate actions; deleting the entry usually doesn’t remove in-app subscriptions. First check Home and Config to make sure your content is still there, then turn on the connection switch to recreate the system configuration. Don’t delete an existing subscription just to restore authorization.
Why wasn’t I asked to authorize again the second time I connected?
Once the system has saved the configuration, subsequent connections can usually use it directly. Check the entry and its status in the system VPN list. Not seeing the prompt again doesn’t mean the system VPN mechanism isn’t being used, and you don’t need to delete a working configuration just to make the prompt appear.
Do I need to delete the configuration when I turn off the connection?
For everyday use, just disconnect. If you don’t want conditions to trigger another connection, check the On Demand settings in Settings → On Demand. Keeping the system configuration makes it easier to connect next time, so you don’t need to delete it after each session. If you do need to remove it, disconnect first and delete only the entry confirmed to belong to Shadowrocket.
Why can’t I connect after buying the app?
Buying the app is not the same as buying a service plan. Shadowrocket is a closed-source commercial app sold as a one-time purchase. You still need to configure your own existing server details. After authorization, check the Home entry, network conditions, and Global Routing in turn. Contact your own service provider to confirm the server is working.