ZEFSubscriptions & Clients
How users connect with one link.
The subscription link
Every user gets a unique URL:
https://vpn.example.com/sub/9f2c…a41b
- Token is 32 random hex chars — unguessable, safe to share with the buyer.
- Leaked? Use Reset token — old link dies instantly.
- Expired, disabled or out-of-volume users get
404(no info leak about why). - Every response carries
subscription-userinfo(used / total / expiry) which clients show as a progress bar. - Link remarks show exactly the username (plus inbound label when extras exist), so apps list clean familiar names.
User dashboard page
When the subscription link is opened in a browser, the user gets a personal dashboard instead of raw text: username and status, usage ring with used/total, days left and expiry, last active time and IP (every subscription fetch is recorded, so a shared link shows up as an unfamiliar IP), one-tap import buttons (v2RayNG, Clash, sing-box), copyable per-protocol links, WireGuard/OpenVPN configs, QR code and recommended apps per platform.
VPN clients (v2rayNG, Clash, Streisand…) always receive raw subscription bytes — detection is by User-Agent, and anything unknown defaults to raw so no client ever breaks. Expired, disabled or out-of-volume users get 404 in both modes.
Formats
| Request | Gets |
|---|---|
/sub/TOKEN in v2rayNG, Streisand, FoXray… | Base64 subscription with all VLESS / VMess / Trojan / SS / Hy2 links (plus WireGuard & OpenVPN sections when enabled) |
/sub/TOKEN?format=clash or any Clash user-agent | Clash YAML: proxies, Zefira select group, block rules, MATCH |
Recommended clients
| Platform | Clients |
|---|---|
| Android | v2rayNG, NekoBox |
| iOS | Streisand, FoXray, Shadowrocket |
| Windows | NekoRay, Clash Verge, Hiddify |
| macOS / Linux | Clash Verge, Hiddify, Nekoray |
QR & config bundles
- QR button per user — scan with the phone, done.
- Download config — single .txt for link-based protocols, ready .conf for WireGuard (with keys + endpoint), ready .ovpn for OpenVPN (CA + cert + key embedded), or a .zip bundle when several apply.
Custom subscription path
During install (or via SUBSCRIPTION_PATH) you can rename /sub to anything, e.g. /s — links become https://domain/s/TOKEN. Obscurity is not security, but it cuts scanner noise.