Use Clash Subscriptions on iPhone: App Store Apps and Setup Guide

Check client compatibility and Clash subscription format first

To use a Clash subscription on an iPhone, you need an iOS client that supports its config format—not a Windows installer copied to your phone. Clash refers to a proxy core and config ecosystem; it does not mean there is one official iPhone app in the App Store. Similar names in search results are no guarantee that an app supports your config.

This guide uses Stash as an example of a client that supports Clash-style YAML configs. Stash is a standalone client, not an iOS version of desktop Clash, and that does not mean it uses the mihomo core. Check the App Store listing and developer documentation for availability in your region, pricing, minimum iOS version, and supported features.

Even if two clients accept YAML, that does not mean every field is compatible. Check each protocol or syntax extension marked “mihomo only.” Apps such as Shadowrocket also have their own subscription and config systems. Support for some of the same proxy protocols does not make an entire Clash config compatible.

Get a compatible client from the App Store

Check the App Store listing before installing

1. Open the App Store on your iPhone, tap Search, and enter a client name such as Stash.
2. Open the product page and check the developer, app description, version history, and Compatibility requirements. Look for explicit support for Clash configs or YAML imports.
3. Install the app using the Get or purchase option shown on its product page. The app's price is separate from your proxy service fee; installing it does not provide proxies or a subscription.
4. When you first open the app, review its config options and help before importing your subscription. Don't enable sample proxies from an unknown source.

If you can't find the app, first check whether it's available in the App Store region linked to your Apple Account. Your iPhone's language and region settings are separate from your App Store account region. To check your account's store settings, go to Settings → your Apple Account at the top → Media & Purchases → View Account. Options may vary by iOS version.

This guide does not specify a particular app version or price because App Store listings change. When troubleshooting, note the actual app version from About or the App Store version history, along with your iOS version. This is more useful for diagnosing compatibility than saying you have the “latest version.”

Before importing: subscription URL, network, and backup

Get a subscription URL for Clash or your iOS client from your provider's account page. It's usually an HTTPS link and may contain an account token. Treat the full URL like a credential: don't share it in group chats, post screenshots that reveal it, or submit it to a public issue tracker.

• Check what you copied: Keep all query parameters. Don't include the page title, line breaks, or trailing punctuation.
• Check that it's valid: Make sure your account has an active service, the subscription URL hasn't been reset, and you haven't reached the device limit.
• Check your connection: Open a regular webpage in Safari first and complete any hotel or campus Wi-Fi sign-in.
• Keep your current config: If you already have a working config, export a backup or note its name before replacing it so you can restore it if needed.

Being able to open your provider's homepage doesn't guarantee the subscription endpoint is reachable; it may use a different domain. Conversely, Safari may show a long block of config text or prompt you to download a file—that can be a normal endpoint response. A sign-in page, CAPTCHA, or HTML error page is not a YAML config and shouldn't be imported as one.

Import a subscription URL and select the config

In Stash, open the Config page, tap the add option, and choose the option to download a config from a URL. Labels vary by version—such as “Download” or “Download from URL”—but the goal is to create a remote config, not add a server manually in the proxy list.

1. Paste the full subscription URL. If prompted for a name, choose something easy to recognize, such as “Daily subscription.”
2. Start the download and wait for the client to fetch and parse the config. When troubleshooting for the first time, download it manually rather than setting up auto-updates and leaving it at that.
3. Select the newly imported config in the config list and make sure it's active. A file appearing in the list doesn't mean it's enabled.
4. Open the proxy groups page and check that selectable proxies appear. For a manual select group, choose a proxy or a nested policy group as needed.
5. Check the operating mode. For everyday use, start with Rule mode, where rules determine whether traffic is direct, proxied, or rejected, rather than treating Global mode as a default fix.

Handle subscription updates and proxy testing separately

Updating a subscription fetches the config or proxy list again; testing proxies checks their connections. These are separate actions. A successful update only confirms that the subscription was fetched—not that every proxy works. A test result only reflects the test target and does not guarantee access to every website.

Some configs use proxy-providers to reference remote proxy files. In that case, the main config can download successfully while the proxy groups remain empty because a provider URL is unreachable. Check the provider's update status instead of repeatedly deleting the main config.

Import a config from a YAML file

Importing a file works when you already have a complete config or can't fetch a subscription directly. Save the .yaml or .yml file to the Files app on your iPhone, such as On My iPhone or iCloud Drive. If you see a cloud icon next to the file, wait for it to finish downloading first.

1. Open the client's Config page and find the option to import from a file.
2. Select the YAML file in the system file picker and wait for it to be parsed.
3. Select the imported config, then check its proxy groups, proxy count, and rule mode.
4. If parsing fails, check the original file's indentation, colons, and quotes. Simply changing the file extension won't fix the issue.

This snippet is only for recognizing the structure. It is not a complete, working config and contains no usable proxies. It shows a rule referencing a proxy group by name; that group must be defined elsewhere.

mode: rule
log-level: info

rules:
  - DOMAIN-SUFFIX,example.com,Web Proxy
  - MATCH,DIRECT

In this snippet, “Web Proxy” must exactly match a group name under proxy-groups, or the reference will fail. Use spaces for YAML indentation, not tabs; take care with values containing special characters such as #. Don't copy an entire desktop config and expect its listener ports, routing, or TUN settings to work unchanged on iOS.

First launch: allow the VPN configuration

Once you've selected a config, return to the client's home screen and turn on the connection. When the system tunnel is created for the first time, iOS usually asks for permission to add a VPN configuration. Check the app name in the prompt, make sure it belongs to the client you just installed, tap Allow, and complete any device authentication requested by iOS.

This permission lets the app route relevant network traffic through iOS Network Extension. It does not verify your subscription or mean all connections use a remote proxy. Traffic matching DIRECT may still connect directly. The VPN icon in the iOS status bar or the status shown in Control Center mainly indicates whether the tunnel is active.

• Denied the request by mistake? Return to the client and start the connection again to trigger another request. If it keeps failing, check the system VPN settings.
• Check the config status: Go to Settings → General → VPN & Device Management → VPN and check the current config and connection status. Some iOS versions also show a shortcut to VPN settings.
• Already using another VPN? Pause other personal VPN apps and disable their auto-connect settings to prevent them from taking over the connection. If your device is managed by your organization, contact your administrator.

You don't need to mark a provider's root certificate as fully trusted to import a subscription. A standard proxy connection also doesn't require an additional MDM profile. If a setup unexpectedly asks for these permissions, stop and verify why. HTTPS decryption is a separate feature and is not part of the standard setup covered here.

Verify the connection: check rule matches, not just the VPN icon

After granting permission, verify in this order: tunnel status → policy selection → actual requests. First confirm that the client shows as connected. Then open a new page in Safari and visit a site you know should work, followed by one you expect to access through the proxy. These are verification steps, not a performance test with guaranteed latency results.

1. Open the client's connection or request log and find the domain you just visited.
2. Check that the matched rule and policy group are what you expect. Rules are usually checked in order; once an earlier rule matches, later rules aren't evaluated.
3. If the policy group is set to DIRECT, the request isn't using a remote proxy just because the VPN shows as connected.
4. Switch to cellular data and repeat the test to distinguish a Wi-Fi restriction from a config issue. Keep an eye on your mobile data usage.

In desktop guides, mixed-port: 7890 is a local mixed HTTP/SOCKS5 listening port. It's not a required setting when importing an iPhone subscription. When the phone connects through the client's tunnel, you also don't need to enter 127.0.0.1:7890 under the current Wi-Fi network's Configure Proxy setting. That's a separate manual proxy setup; mixing the two can make troubleshooting harder.

Likewise, don't follow desktop guides looking for an identically named “TUN mode” switch. On iOS, the client routes traffic through a system network extension. Its DNS and routing capabilities depend on the client and iOS limitations; this is not the same as running desktop mihomo with all tun fields available.

Common import and connection issues

Change one variable at a time

Keep the original config while troubleshooting, and note when the error occurred, the client and iOS versions, and your current network. Try a different proxy, then another network. Don't change the mode, rewrite DNS, edit rules, and reinstall the app all at once, or it will be hard to tell what helped.

For DNS errors, first determine whether the subscription domain, proxy server domain, or destination website failed to resolve. Each points to a different part of the connection, so one public DNS address won't fix them all. Corporate, school, and managed networks may also restrict external DNS or VPN connections; follow the rules for your network.

If you need help, share the exact error and screenshots with sensitive details removed. Hide subscription query parameters, proxy passwords, account email addresses, and full server credentials. Before investigating a specific website, confirm these four things: the config parses, the right config is selected, VPN permission is granted, and the rule and proxy selection are as expected. That's usually more useful than reinstalling everything.