What a VPN Key Actually Is, and How to Import One

Outline keys, WireGuard configs, subscription links, QR codes. Four names for the same idea, with different formats and one important security property in common.

If you have bought a VPN that has no app, the thing you receive is a key. People search for outline vpn keys, wireguard configs and subscription links as if they were different products, and the confusion is understandable: they look nothing alike, and every provider names them differently. Underneath they are the same object - a small piece of text that tells a client where to connect and proves you are entitled to. This article explains what is inside one, how the four common formats differ, and how to load each one on any platform.

What is inside a key

Strip away the encoding and every VPN key contains the same four things:

• The endpoint. An address and port telling the client which machine to talk to.
• Cryptographic material. A private key for you, a public key for the server, or a shared secret - depending on the protocol. This is the part that authorises you.
• Routing rules. Which traffic goes through the tunnel. Usually everything, expressed in WireGuard as an AllowedIPs value of 0.0.0.0/0 and ::/0.
• Operational settings. The DNS resolver to use, the MTU, and how often to send keepalive packets. Small values that decide whether the connection behaves well - see our guide on disconnects for why they matter.

There is no username, no password and no email anywhere in that list. That is the design: possession of the key is the authorisation. It is the same model as a house key, and it carries the same consequence, which we will get to.

The four formats you will meet

A WireGuard configuration is a plain text file with a .conf extension and two sections. Interface describes your side: your private key, your address inside the tunnel, DNS and MTU. Peer describes the server: its public key, its endpoint, allowed IPs and keepalive. It is readable, and reading it is worth two minutes because you can verify that DNS is set and that AllowedIPs really covers everything.

An Outline key is a single line starting with ss://, holding a Shadowsocks server, port, cipher and password packed into one base64 string. Outline is popular in censored regions because its client is simple and its traffic is less obviously a VPN than plain WireGuard. It is not WireGuard and will not import into a WireGuard client - a mismatch that causes a great deal of confusion.

A VLESS link starts with vless:// and encodes a server, a UUID identifying you, and transport parameters. With Reality, the connection imitates an ordinary TLS session to a real third-party site, which is the strongest circumvention option in common use. It needs a client that speaks it: Happ, v2rayNG, NekoBox and similar.

A subscription link is an ordinary https:// URL. Opening it returns a list of configurations, and a client that supports subscriptions re-fetches it periodically. This is the format worth preferring: when a provider adds a server or an address gets blocked, the change reaches you without you importing anything. Ours is a subscription link, delivered with a QR code so a phone can take it without typing.

• A key is not a licence code. It is the credential itself - closer to a house key than to a receipt.

Importing on each platform

The three steps never change: obtain the key, open a client that speaks its format, add it from a QR code, the clipboard or a file.

On iPhone and iPad, install WireGuard for ordinary networks or Happ for filtered ones. In WireGuard tap the plus button, choose Create from QR code and scan; or choose Create from file if you have a .conf. In Happ tap plus and add from clipboard. Then allow the VPN profile when iOS asks - that system prompt appears once per client and is not optional. Turn on On-Demand in the tunnel settings so the connection returns by itself after a reboot or a network change.

On Android the flow is identical: WireGuard or Happ, plus button, scan the QR or paste from clipboard, accept the system VPN request. Afterwards go into the system network settings and enable Always-on VPN together with Block connections without VPN - that combination is a kill switch at the operating system level, better than anything a client can offer.

On Windows and macOS, install the WireGuard client, download the .conf from your cabinet and choose Add Tunnel, Import from file. On macOS, tunnels also appear in the menu bar, which is the fastest way to switch between locations. Both platforms accept a QR code only through third-party tools, so the file is the sane route on a desktop.

On a router the configuration is manual and worth doing once: an OpenWrt or Mikrotik box with a WireGuard peer protects every device on the network, including those that cannot run a VPN client at all - a television, a console, a printer you would rather not think about.

Treating the key as what it is

Because the key is the whole credential, the security rules are short and worth following literally.

• Do not post it anywhere. A key in a screenshot, a support forum or a group chat is an open door. Screenshots of QR codes are the most common accident, because a QR does not look like a secret.
• Store it in a password manager. The moment you receive it, not later. This is the single most useful habit in this article.
• Sharing it means sharing the connection. Two devices on one key generally work but can conflict, and everything either device does exits from the same address.
• Expect no recovery. A provider that never took your email has no way to prove you are you. Ours cannot restore a lost key, and that inability is the same property that makes the model private.

That last point is the trade at the centre of no-account VPNs. Nothing to lose in a breach, and nothing to fall back on if you are careless. A password manager resolves it completely.

When a key stops working

Three ordinary reasons, in the order to check them. The plan expired - access simply stops when time runs out, because nothing renews on its own. The format does not match the client - an Outline key will not load in a WireGuard app, and a vless:// link needs a client that speaks VLESS. Or the endpoint is blocked on your network, which looks like a key problem but is not: the same key on mobile data connects immediately.

That third case is the one to recognise, because people waste hours re-importing a perfectly good key. If a config works on one network and never on another, the key is fine and the path is filtered. That is what obfuscated profiles are for - our protocol comparison covers which one to use where.

FAQ

What is an Outline VPN key?

A single ss:// line containing a Shadowsocks server, port, cipher and password. It works only in Outline or another Shadowsocks-compatible client. It is not interchangeable with a WireGuard config, which is the most common reason an import fails.

Can I use one key on several devices?

Usually yes, and it is generally fine for a phone and a laptop. Some setups conflict when two devices use the same peer simultaneously, and everything both devices do shares one exit address. If that matters, use a separate key per device.

What happens if I lose my key?

With a no-account provider, the access is gone. There is no email on file and no identity check to run, so there is nobody who can prove the key was yours. Save it in a password manager the moment you receive it - that is the whole mitigation.

Is a subscription link better than a single config?

In practice yes. A subscription refreshes itself, so new servers and replaced addresses reach you without a manual import. A single config is a snapshot that ages, and it ages fastest exactly where you need it most - on networks that block addresses.

Do I need the provider's own app to use a key?

No, and it is arguably better not to. Standard clients like WireGuard and Happ are widely reviewed, open source and updated independently of any provider. A provider that ships no app of its own also ships no app that can quietly gain new permissions.

If the key connects but the tunnel misbehaves: Why your VPN keeps disconnecting