Android VPN Setup: Install the App, Import Your Subscription, Grant Permissions, and Verify It Works

Getting a VPN working on Android really comes down to five stages: install the app, import your subscription, grant the system VPN permission, add the app to the battery whitelist, and verify it works. When a connection fails, the cause is usually not the route but one of these steps being blocked by the system — an unconfirmed permission dialog or a background process killed by battery saving both look like “it won't connect.”

This guide walks through those five steps in the order you perform them: what to do on each screen, what you should see when it works, and how to check things yourself when it doesn't. Phones and tablets follow the same flow, and one subscription covers an unlimited number of devices — you can import it on several at once.

Before you start: account, subscription, and device

Before you begin, make sure you have three things: an account, a subscription link, and an Android device with a working internet connection.

Account. Creating one takes only a username and password — no email address required. If you already have an account, open the user panel and log in; if you don't, you can create one from the panel's home page too.

Subscription link. After logging in, copy it from the subscription or overview section. It's a long address starting with https and ending in a long token string. That token works like your account credentials — anyone who has the link can use up your data, so don't screenshot it into group chats or paste it into public posts. If it does leak, reset it once in the panel and the old link stops working right away.

Device. The Android app shares the same subscription as the Windows, macOS, iOS, and Linux clients. Just import it on each device separately — there's no limit on how many.

Monthly plan data resets each month on your activation date, and data packs last until they're used up — they never expire. So the data you use while testing is all covered by your plan; there's no need to hold back.

Step 1: Install the Android app

Get the app from the official source: log in to the user panel, open the download section, and choose Android to get the installer. Check where it came from before installing, and don't use mirrors of unknown origin.

During installation, the system may warn that apps from unknown sources are blocked. The path is Settings → Apps → Special app access → Install unknown apps; grant temporary permission to the browser or file manager you're using, then turn the switch back off once the install finishes.

Once it's installed, don't rush to connect — go back to the home screen, confirm the icon is there, then open the app. On first launch it will usually ask for notification permission; allow it. Android shows foreground service status and the connection toggle in the notification shade, so denying notifications leaves the connection state with nowhere to display and makes it harder to keep the app alive in the background.

Step 2: Import your subscription

The subscription is where your server list comes from. Importing it is a single action, but the details are easy to get wrong. Follow this order:

1. Copy the subscription link in the panel. Copy the whole thing — don't drop the token characters at the end and don't change the letter case by hand.
2. Open the app, go to the “Subscription” or “Config” screen, and choose “Import from clipboard.” If your client has no clipboard option, long-press the input field and paste the full link manually.
3. Give the subscription a label (for example, “Main”), and leave auto-update on so the client re-fetches the server list on a regular schedule.
4. Tap “Update subscription” once and wait for the server list to appear. An empty list means the fetch failed — first check whether your current network can reach the panel's domain.
5. Pick a route from the list, go back to the main screen, and tap Connect.

The panel usually offers a QR code as well: log in on a computer and scan it with the Android app — the result is the same as importing from the clipboard. After you change plans or routes are adjusted, you'll need to tap “Update subscription” once before the server list refreshes.

Protocols and route types in the server list

Besides the region, the server list usually labels each entry with a protocol and a route type. The protocol (Trojan, VLESS, Hysteria2, Shadowsocks, and so on) determines how the client and the server talk to each other; the route type determines how traffic travels across the network. Direct connections go straight from the client to the exit server — the shortest path. Relay routes pass through an extra entry server, which suits networks where direct connections are unstable. IEPL routes run over a dedicated line that avoids congested nodes on the public internet. Day to day you don't need to switch protocols by hand — just pick a route by region. Only when a particular route won't connect do you need to try another one or another route type.

Step 3: Grant the system VPN permission

The first time you tap Connect, a system dialog appears with the title “Connection request,” telling you that an app wants to set up a VPN connection. That dialog is drawn by Android itself, not by the app, and no app can bypass it.

You have to tap “OK.” If you tap “Cancel” by mistake, that authorization is recorded as denied and the dialog may not appear again. There are two ways to recover: clear the app's data and re-import your subscription, or go to Settings → Network & internet → VPN, check for a leftover entry, delete it, and try again.

Some customized systems block “pop-up windows in the background”: go to Settings → App management → the client → Permissions and turn that item on. Otherwise the connection request dialog never appears, which looks like “I tap Connect and nothing happens.”

Also note that Android allows only one active VPN tunnel at a time. If another VPN or network accelerator is running on the device, disconnect it first, then connect with VPNPF.

Step 4: Add the app to the battery whitelist

If the connection works but drops a few minutes after the screen locks, battery management is almost always killing the background process. The fix is to whitelist the app so it can run in the background without restrictions.

The menu names differ from one system to another, but the idea is the same: search Settings for “battery,” “background,” or “auto-start,” find the entry for the client, and set its battery policy to “Unrestricted” or “Allow background activity.” On models with separate “Auto-start,” “Associated start,” and “Background activity” switches, turn all three on. Common paths (names vary slightly by OS version):

• Near-stock Android: Settings → Apps → the client → Battery → Unrestricted;
• MIUI / HyperOS: Settings → Apps → App management → the client → Battery saver → No restrictions;
• ColorOS / OriginOS: Settings → Battery → App power management → Allow background activity;
• EMUI / HarmonyOS: Settings → Battery → Launch management → Manage manually, and turn all three switches on.

Checking is simple: lock the screen, wait ten minutes, then unlock and see whether the VPN icon is still in the notification shade. If it's gone, the process was killed — go back and redo this section. One more thing: swiping the client away in the recent apps view makes some systems clean up its background service too, so lock the app in the recents list to avoid swiping it by accident.

Step 5: Verify it's actually working

The last step is confirming it really works, rather than trusting the word “Connected” in the app. Check each item:

• ✅ A persistent VPN key icon appears in the notification shade and the app shows Connected;
• ✅ Open the My IP page on this site — the exit region shown matches the route you picked; choose a Japan route, for example, and it shows Japan;
• ✅ An international site that wouldn't load before now loads completely;
• ✅ After ten minutes locked, the icon is still there and pages still load;
• ❌ The icon flashes and disappears → battery management killed the process; go back to Step 4 and whitelist the app;
• ❌ Pages load but you get a “not available in your region” message → try another route in the same region instead of retrying the same one;
• ❌ The app says Connected but no page will load → start with the Private DNS check below.

If the client is running in split-tunnel mode, only traffic that matches the rules goes through the tunnel. To confirm the route itself works, switch to global mode, test once, then switch back. If a particular app isn't going through the proxy, check whether the rules classified it as a direct connection, and add that domain to the proxy rules if needed.

Common failures and how to fix them

Here are the places people get stuck most often in those five steps, in a table you can match by symptom:

Summary: what to expect after the five steps

Using the Android client isn't complicated in itself; the hard part is how differently each system manages background processes and permissions. Once these five steps are done, switching devices or routes is just repeating steps three through five. For side-by-side instructions per platform, see the getting started guide; for more detailed troubleshooting entries, see the troubleshooting handbook; and for the regional and route-type breakdown, see the routes page.