For iPhone and iPad users who installed Shadowrocket from the App Store and see a system permission prompt when connecting for the first time. First, distinguish the system VPN configuration from an in-app subscription. Then follow the steps to allow the configuration, check its system entry, or recreate it after declining or deleting it. Finally, use the connection status to decide whether to check permissions or your connection setup.
1. Verify the app, then understand the system permission
Shadowrocket is a paid client for Apple platforms, available exclusively from the App Store. On the product page, verify the developer, Shadow Launch Technology Limited, the app ID 932747118, and the one-time purchase details. Refer to the App Store listing for system requirements. To verify the app's source, see How to verify the official App Store listing. Don’t assume every configuration prompt you encounter online applies to this app.
The first time you turn on the connection switch in Home, iOS or iPadOS may show a system prompt asking to add a VPN configuration. This asks for permission to create the VPN configuration required by the app’s system network extension. It is not a request to buy the app again or enter App Store payment details. The exact wording, button labels, and verification steps can vary with the system language and device state.
Before granting permission, make sure the prompt was triggered by an action you just took in Shadowrocket and that the app name shown is correct. If the prompt appears unexpectedly, cancel it, return to Home, check your action, and try again. The system warning that traffic may pass through a VPN explains the scope of the permission. It doesn’t mean every connection will use a remote proxy, nor does it confirm that a working connection has been established.
2. Add a VPN configuration for the first time
Start the process in the app. You don’t need to enter a VPN server manually in system Settings first. The manual VPN form in Settings is not the same configuration entry point as Shadowrocket’s network extension. Pasting a subscription URL into that form cannot replace importing it in the app.
-
Check your existing configuration
Open Shadowrocket → Home and make sure a connection is available to select. If you haven’t configured one yet, import it using the details provided by your own service provider. Keep subscription credentials on your device; don’t include them in public screenshots or support requests.
-
Start a connection
In Home, select the connection you want to use, then turn on the switch at the top. Check whether the prompt is a system request to add a VPN configuration or a different in-app message; don’t mistake one for the other.
-
Allow the system to add the configuration
Check the app name in the prompt, then tap Allow or the equivalent button in your system language. If the system asks you to verify your identity, follow the on-screen instructions. Don’t enter your subscription password as your device passcode.
-
Check the connection status
Return to Home and check the connection switch and status. If it’s still off, start the connection manually again. If it shows as connected, test access to confirm it works; a dismissed permission prompt alone doesn’t mean the connection succeeded.
-
Check the system entry
Open system Settings → General → VPN & Device Management → VPN and look for an entry associated with Shadowrocket. Menu names may vary slightly; use the labels shown on your device.
Device authentication is handled by the system. If your device is subject to organization management, Screen Time restrictions, or another policy that prevents network configuration changes, repeatedly toggling the switch won’t remove those restrictions. First confirm that you’re allowed to add VPN configurations on this device, then ask the device administrator to address the relevant policy.
3. VPN configurations, subscriptions, and profiles: what’s the difference?
“VPN profile” is often used as a catch-all for VPN entries, but it helps to distinguish them when troubleshooting. The VPN configuration Shadowrocket creates through a system interface is different from a configuration profile installed from a webpage and from a device management profile. They may appear in nearby Settings sections, but they have different sources, purposes, and consequences if deleted.
| Item to check | Location or entry point | Purpose | What to do if deleted |
|---|---|---|---|
| System VPN configuration | System Settings → General → VPN & Device Management → VPN | Stores the information the app needs to establish a system VPN connection | Return to Shadowrocket, start a connection, and follow the prompt to grant permission again |
| In-app connection and subscription | Shadowrocket → Home | Stores connection settings and subscription groups for your existing service | Reimport using the valid details you’ve kept |
| In-app rules configuration | Shadowrocket → Config | Manages rules and related configuration | Restore it from your own configuration source and check which item is selected |
| Configuration or management profile | The relevant entry under system VPN & Device Management | May configure accounts, certificates, management policies, and other settings based on its contents | Check with the configuration source or device administrator first; don’t delete profiles at random to troubleshoot |
Bottom line: restore only the missing layer
If the connection is still listed in Home but the system VPN entry is gone, start by requesting system authorization again. Don’t also delete subscriptions, rules, or device management entries. That expands the recovery work and makes it harder to tell which action fixed the issue.
Allowing the system to add a VPN configuration won’t import a subscription for you. Deleting the system VPN entry usually won’t erase data in Home. Uninstalling the app is a separate action that may affect local app data, so don’t make “uninstall and reinstall” your first step for a permissions issue.
4. Restore access after declining or accidentally deleting the configuration
If you tapped Don’t Allow the first time, return to the app and make sure the connection switch is off, then start the connection again. Don’t create a same-named entry manually in system VPN settings; the name alone doesn’t ensure that it’s correctly associated with the app’s network extension.
-
Pause automatic connection triggers
If you enabled on-demand connections, first check Shadowrocket → Settings → On Demand. Note your existing options, then temporarily disable the relevant triggers to prevent connections from restarting automatically while you troubleshoot.
-
Check the system entry
Go to system Settings → General → VPN & Device Management → VPN and check whether Shadowrocket is listed. Review only the entry related to this app; don’t delete other configurations to test a fix.
-
Request permission again
Return to Home, select an existing connection, and turn on the switch. If the entry is missing, allow the system request when it appears and complete device authentication. If no prompt appears, first check whether the configuration is already saved in system Settings.
-
Verify that it’s restored
Check the system VPN entry and the status in Home again. If permission was granted but the connection fails, keep the existing configuration and troubleshoot the connection settings and Log. If you still can’t add it, check for device management restrictions before deciding what to do next.
If you accidentally deleted a subscription in Home rather than the system VPN entry, granting system permission again won’t restore the subscription. Use the subscription details you’ve saved. Verify only the information originally provided by your service provider, and don’t send the full URL to anyone who doesn’t need it. If you deleted a rules configuration in Config, restore that layer separately instead of mistaking a rules issue for missing system permission.
5. Authorized but can’t connect? Troubleshoot by status
Start by noting three things: whether the system VPN list has an entry, whether the connection switch in Home stays on, and whether access actually fails. These observations help pinpoint the issue better than remembering that a prompt appeared. If the system entry exists and the connection starts, check the connection logs instead of repeatedly deleting and re-adding the authorization.
Error: VPN Connection
Cause and fix: VPN Connection is a possible title for a system connection error alert. It doesn’t identify the specific cause of failure and isn’t a request to add a VPN configuration. First, note the full message below the title, then compare it with the status in Home and check Log. Don’t assume the subscription is invalid or permission was denied based on the title alone.
- No system entry: First check whether you allowed the request and completed device authentication, then check for organization policy restrictions. Changing routing rules usually won’t fix a failure to add the configuration.
- Entry exists, but the connection drops immediately: Check that the selected connection settings are complete and the service is active. Review the Log entry for the same attempt. Keep any necessary error text, but hide server addresses, account details, and credentials before sharing it.
- Connection stays on, but some destinations are unreachable: Check the current selection under Home → Global Routing. Direct doesn’t send traffic through the selected proxy. Config routes traffic according to the active rules, so “connected” doesn’t mean “all traffic is using a proxy.”
- Connection turns back on after you switch it off: Check Settings → On Demand, and see whether the corresponding system VPN entry has a Connect On Demand option enabled. This is an automatic connection trigger, not a new purchase or permission request.
Proxy, Direct, Config, and Scene are routing modes under Global Routing, not four levels of system authorization. Changing modes doesn’t remove the system VPN configuration requirement. During troubleshooting, change one setting at a time and note the status before and after, so you can distinguish routing rules from remote connection and permission issues.
6. How the system VPN tunnel is involved in a connection
The app first requests a system VPN configuration, which the system saves after you grant permission. When a connection starts, the network extension processes traffic within its scope according to that configuration. Whether traffic then uses a remote proxy depends on the app’s current routing, rules, and connection settings. The VPN indicator in the status bar doesn’t reveal the exact outbound route.
The VPN status indicator shows the system connection state; it doesn’t prove anonymity or access to a destination. DNS resolution, the destination service, and your existing service’s connection capabilities can all affect access. Because these steps are separate, you don’t need to change protocols or bulk-edit rules when restoring the system configuration. Restore authorization first, then check the rest of the connection path.
7. Common questions about first-time authorization
Do I need to buy the app again if I tapped Don’t Allow?
No. Declining VPN permission doesn’t mean you need to buy the app again. Return to Home, turn off the connection switch, then start a connection and follow the system prompt. Your purchase and the VPN configuration on your device are separate.
Does Shadowrocket not appearing in Settings mean it isn’t installed correctly?
First make sure you’re checking system Settings → General → VPN & Device Management → VPN. If the app is installed but hasn’t successfully added a system configuration, its entry may not appear in that list. Return to Home, start a connection, and watch for the permission prompt.
Will deleting the VPN entry also delete my subscription?
The system VPN entry and your in-app subscription are managed separately. First check Home to see whether the subscription is still there. If it is, start a connection to restore the system configuration; you don’t need to import it again. If the in-app data was also deleted, restore it separately using your own original details.
Why am I asked for permission again on my iPad?
VPN configuration permission applies to the current device. It isn’t automatically granted because you allowed it on another device. On your iPad, start a connection from Home and follow the prompt. Refer to the App Store listing for purchase eligibility, device compatibility, and system requirements.
After I allow it, will I have to tap Allow every time?
If the configuration stays in place, everyday connections usually won’t repeat the initial setup. If you’re prompted every time, first check whether the configuration was deleted or a device management policy is resetting settings, then note the full prompt text. Don’t repeatedly clear the configuration as a test.