How to Install a Clash Client on iOS: App Store Access and Subscription Setup

Understand the difference between the client, config, and subscription

When you search for “Clash iOS” on your iPhone, you’re usually looking for a proxy client that can use your existing subscription—not a way to install a Windows app on your phone. The original Clash project has not released an official iOS app that can be identified by name. Compatible apps in the App Store have their own developers, config formats, and feature limitations. The name of this site does not indicate who developed those apps.

Before installing anything, confirm three things: which client you plan to use, what subscription format your provider offers, and whether it includes protocols supported by the client. Being able to download an app doesn’t guarantee that it can import your subscription. Importing nodes doesn’t guarantee that all the rules in the config will work.

Item	What it means	Check before importing
Stash	An iOS client that uses Clash-style YAML configs	Use the Stash config provided by your service first, and check which protocols and fields it supports
Shadowrocket	A client that uses its own node, subscription, and rules configuration	Choose a subscription specifically labeled for Shadowrocket; don’t assume a complete Clash YAML config is a universal format
Subscription URL	A remote URL that returns a list of nodes or a complete config	Confirm the output format, account status, and permission to update
Profile	A config loaded by the client	Check that nodes, proxy groups, rules, and DNS settings are all present

Get a client from the App Store

Check the listing before you install

Visit the download center on this site for iOS client details and the relevant App Store link. On the App Store, check the app name, developer, and listing details before installing.
Expand “Compatibility” in the App Store listing and confirm your iOS version meets the requirements. Don’t identify an app by a similar name or icon alone.
Check the price and purchase terms shown in the App Store. App costs and proxy service subscriptions are charged separately; buying a client doesn’t include access to proxy nodes.
After installing the app, open it from your Home Screen. Find the config management section and import your subscription before connecting; an empty config can’t route traffic.

If the App Store says “This app is currently not available in your country or region,” the app isn’t offered in your store region. That doesn’t mean your subscription URL is invalid. Check the current App Store listing for availability, price, and minimum iOS version.

What to check if you can’t find the app

To check your App Store account region, go to Settings → your Apple Account at the top → Media & Purchases → View Account → Country/Region. This is separate from the region set under Language & Region in iOS settings. Changing your device’s region alone won’t change the App Store catalog.

Use your own Apple Account and review Apple’s restrictions on changing account regions, balances, and active subscriptions.
Never enter your proxy provider login details on your Apple Account page or give your Apple Account password to someone offering to install the app for you.
Apps installed from the App Store usually don’t require trusting an enterprise developer certificate. If an alternative installation process asks you to install an enterprise certificate or a mobile device management profile, verify the source first.

Get a working subscription URL

Sign in to your provider’s account portal and choose the subscription option for your client. For Stash, look for a config explicitly labeled “Stash.” For Shadowrocket, use its dedicated subscription or a node subscription supported by its documentation. A URL starting with https:// does not mean the formats are interchangeable.

Subscription URLs often contain account tokens. They’re not ordinary help page links: anyone with the URL may be able to view node details or use your service. Don’t share it in public chats or paste a real subscription URL into an untrusted online converter.

Four checks before importing

Complete URL: Copy the entire address, including parameters after ?. Remove any quotes, spaces, or line breaks added by your chat app.
Correct URL type: The client needs a subscription endpoint, not a login page, payment page, or account home page.
Active account: An expired account, exhausted data allowance, or reset token may prevent the URL from returning content.
Compatible format: A complete Clash-style config typically includes proxies or proxy-providers, along with proxy-groups and rules. A node list may not include routing rules.

Some endpoints return different content depending on the client’s request headers. If a URL opens in a browser, that only confirms the browser received a response; it doesn’t prove the client can parse it. Check the result and config in the app.

Import the subscription and select the config

Using Stash as an example

Depending on the version, the menu may be labeled “Config,” “Profiles,” or something similar. The goal is to add a remote config, not a manual node. Follow the steps by what each control does; labels may vary by version.

Open config management, tap the add button, and choose the option to download from a URL or import a remote config.
Paste the subscription URL and give the config a recognizable name, such as “Personal subscription - iPhone.” Don’t include the full token in the name.
Download or save the config, then wait for the app to parse it. If an error appears, note the error type; don’t share the full URL if it contains a token.
Select the imported item in the config list and confirm it’s the active config, not just a saved entry.
Open the proxy groups page and check that the expected groups appear. For any group set to manual selection, choose a node or another proxy group.

If your provider offers an “Open in app” link, iOS may launch the client using a URL scheme. A successful handoff only means the process started; confirm the download finished and the active config changed. If Safari doesn’t open the app, return to the client and import the URL manually.

Check rule references, not just the number of nodes

This snippet shows how proxy groups and rules relate. It is not a complete config that can connect on its own; valid node definitions must come from an active subscription.

proxy-groups:
  - name: Proxy selection
    type: select
    proxies:
      - DIRECT

rules:
  - DOMAIN-SUFFIX,example.com,Proxy selection
  - MATCH,DIRECT

DOMAIN-SUFFIX matches a domain and its subdomains. Rules are evaluated from top to bottom. Here, “Proxy selection” only contains DIRECT, so it won’t send traffic through a proxy. In a working config, the group must reference nodes from your subscription or another valid proxy group. A rule that references a nonexistent name may cause the config to fail to load.

Subscription updates can overwrite manual changes. Before customizing rules, check whether your client supports local overrides or separate rule configs. Keeping a recoverable copy makes it easier to roll back than deleting the original subscription.

Approve the VPN configuration and connect

The first time you connect, iOS will usually ask whether the app can add a VPN configuration. Confirm that the prompt names the client you just installed, tap Allow, then authenticate with your device passcode or biometrics if requested. This grants access to the system network tunnel; it doesn’t purchase a subscription from your provider.

Return to the client and confirm the active profile and proxy group are correct.
Tap the connection switch and approve the VPN configuration when iOS prompts you.
Wait for the app to show that you’re connected before testing the network. Don’t repeatedly toggle the connection while it’s still being established.
If needed, go to Settings → General → VPN & Device Management → VPN to check the connection status for the relevant configuration.

iOS clients typically route traffic through a tunnel provided by Network Extension. Desktop steps for enabling a system proxy don’t apply. Don’t copy your computer’s 127.0.0.1:7890 setting either: on an iPhone, 127.0.0.1 points to the phone itself, not your computer.

A test sequence for your first connection

Test in this order: config loaded → tunnel connected → request matched a rule → page loaded. Change one setting at a time so you can tell whether a failure comes from the node, DNS, or a rule.

Check the config: Confirm the active config name, look for parsing errors, and make sure proxy groups aren’t set to DIRECT or REJECT when that’s unsuitable for the request.
Check the node: Use the client’s built-in connectivity test. Its result only reflects the connection to the test destination; it doesn’t guarantee that video, downloads, or other sites will work.
Check a real request: Open the site you need in Safari over HTTPS, then check the client’s connection log for the domain, matched rule, and final route.
Check direct connections: Visit a site that should bypass the proxy and confirm the rules aren’t sending every request through the same route.
Check network switching: Switch from Wi-Fi to cellular and test again. If only one network fails, check its access restrictions and whether the node is reachable over that network.

DNS issues often appear when the tunnel connects but requests stall during name resolution. First restore the DNS settings recommended by your provider. Don’t layer on an unfamiliar encrypted DNS service, another VPN, and custom rules all at once. fake-ip is part of a specific config mechanism, not a universal fix that needs to be enabled manually on iOS.

Common errors and how to fix them

Issue	Check first	Next step
Download returns HTTP 401 or 403	Token, account permissions, or provider access restrictions	Sign in to your provider portal and get the subscription again. If needed, ask the provider why access was denied.
Download returns HTTP 404	Check whether the URL path is complete and the endpoint has changed	Copy the current subscription URL again; don’t guess the endpoint path
YAML parsing error	Check whether the response is a login page or the formatting and indentation are damaged	Get the format for your client; don’t save a web page as a config
Unsupported protocol or field	Check whether the config is intended for a different core	Choose a Stash config or one made for your client, and check its feature support
Import succeeds, but expected rules are missing	Check whether you imported only a node list	Add rule config supported by the client, or use a complete profile
Can’t access sites after connecting	Active node, final route, DNS, and available service data	Check the log for one failed request and test each factor instead of changing everything at once

Update the subscription or switch devices

If a node goes offline or rules change, update the config in the client and confirm the target profile is still active. Automatic update intervals don’t guarantee that iOS will run the task on schedule in the background. If you haven’t opened the app for a while, update manually before connecting so you can confirm the result.

After switching iPhones, the app may be restored, but check VPN permissions, the selected proxy group, and the remote config again. If your subscription URL has been exposed, reset its token in your provider portal and update every device still using the old URL. For more basic steps, see the user guide. For details on rules and proxy groups, see Advanced configuration.