Provider portal¶

The portal at provider.smproxy.io provides self-service registration, a Provider ID, usage statistics, in-app messages and link generators. It is free.

Create an account · Sign in

Portal sections¶

The portal also manages client settings for your subscriptions, subscription cards, backup addresses and user messages.

Section	What you can do
Home	View your Provider ID, account status and summary.
Statistics	View devices, first appearances, activity, platforms and app versions; open an individual HWID's history.
Messages	Create in-app messages and select recipients and delivery conditions.
Domains	Verify ownership, configure subscription migrations and backup addresses, and open settings for a domain.
Client settings	Set shared values and per-domain overrides for censorship bypass, routing, appearance and contacts.
Encrypted link	Generate an encrypted subscription link; see Link generators.
HWID link	Generate a device-bound link.
Account	Configure a custom Provider ID, description, logo, website, Telegram and two-factor authentication.

The portal supports Russian and English. On mobile, open sections through the navigation menu.

Statistics in three steps¶

Register.
Copy your Provider ID, or set your own.
Send it with the subscription as the providerid or s-providerid response header.

Your users then appear in the portal statistics. See Provider ID and What needs an active Provider ID.

Client settings¶

Where to find them¶

Open Client settings in the portal menu to configure shared provider values.

For one domain, open Domains → Settings beside that domain. These values apply to subscriptions whose host matches that verified domain.

Using the portal does not require adding each selected field to your subscription server's response manually. Values apply to subscriptions on your account's verified domains. The portal does not edit your panel's configuration. Direct subscription headers are a separate integration method described in Subscription metadata.

Application depends on the client version, when it receives the settings and the rules for each field. Saving a form does not mean every device has already received the changes. Connection-related settings may require a VPN reconnection.

Shared values and domain overrides¶

There are two levels:

Global settings provide the base values for the provider's domains.
Domain settings override those values for one domain.

At the global level, an unset field supplies no value. At the domain level, Inherit keeps the global value. Where available, the inherited value is shown beside the field.

Action	Result
Inherit	The domain uses the shared value.
Disable	Supplies an explicit disabled value, such as `off`, overriding a shared enabled value for that domain.
Do not send	Where supported, suppresses the field even if it is configured globally. This does not necessarily reset a value already saved by the client.

You can temporarily disable an entire level without deleting its entered values. Disabling a domain level restores inheritance from global settings. Disabling the global level skips its values, while individual domain settings remain effective.

Copying and value encryption¶

Copy settings from the global level or another domain in your account into the current level. This replaces the set, rather than filling only missing fields. Check the source before copying.

Some fields support encrypted values. The portal produces crypt1/… values understood by the app. This encrypts one setting and is different from generating an encrypted link for the entire subscription.

Fragmentation, noise, DNS and server-address resolution offer Custom parameters. Entered parameters remain as a draft when switching to enabled or disabled; the draft itself is not applied to the client.

Censorship bypass¶

Field	Key	Purpose and example
TLS fragmentation	`s-fragment`	Splits TLS ClientHello. Enable defaults or enter custom parameters: `packets=tlshello;length=50-100;interval=10-20`.
REALITY: disable post-quantum key exchange	`s-reality-disable-pq`	Removes ML-KEM from the REALITY handshake while preserving the selected fingerprint. May help with stalls or timeouts. Ordinary TLS is unchanged. Enable/disable only, without custom parameters.
Noise packets	`s-noise`	Adds noise before the connection. Example: `type=rand;packet=50-100;delay=10-20`.
In-tunnel DNS (DoH)	`s-dns`	Configures DoH for in-tunnel DNS, subject to the configuration's routing rules. Use the built-in resolver or a custom HTTPS URL.
Resolve server address	`s-resolve`	Resolves the VPN server through DoH before connecting. Multiple resolvers can be separated by commas; an optional bootstrap IP uses `;ip=`. Example resolver: `https://doh.ffmuc.net/dns-query`.

s-reality-disable-pq accepts on/off, true/false and 1/0, case-insensitively. Explicit disable keeps the original preset even if the user enabled the local switch. When no value is supplied, the local app behavior applies. Reconnect after a change.

For portal-managed REALITY settings, use Apple 2.0.40 (376), Android 2.0.6 (503) or Windows/Linux 2.0.2 (259) and an active provider account, as with fragmentation. Direct subscription headers, URLs and files have different eligibility rules: they work without an active Provider ID. See Feature eligibility for other fields.

See Censorship bypass, including REALITY limitations and behavior.

Routing¶

Field	Key	Purpose
Routing profile	`routing`	A profile URL, base64 value or JSON. Refreshed with the subscription.
Auto-updating profile	`autorouting`	Profile URL that the app subsequently refreshes itself.
Profile update URL	`routing-update-url`	Source for profile updates; can be set separately.
Update interval	`routing-update-interval`	12–168 hours; default 24.
Profile name	`routing-profile`	Selects the profile for this subscription's servers, overriding the user's global choice. The portal accepts up to 64 characters.

The routing refresh interval and subscription refresh interval are different settings. See Routing profiles for formats and examples.

Subscription card¶

Field	Key	Purpose
Subscription name	`profile-title`	Name in the subscription list; up to 128 characters.
Service name	`s-sitename`	Service name on the subscription card; up to 128 characters.
Website	`s-siteurl`	Service website link.
Telegram	`s-tgbot`	Bot or channel; `@username` is accepted.
Subscription page	`profile-web-page-url`	Link to the user's account page from the subscription card.
Subscription refresh	`profile-update-interval`	Positive whole number of hours between subscription updates.

Enter ordinary text without manually encoding it as base64: the portal encodes the relevant text fields for you.

Field	Key	Purpose
Announcement	`announce`	Text above the server list.
Announcement link	`announce-url`	Makes the announcement clickable; without announcement text, nothing is displayed.
Banner	`banner-text`	Text block on the subscription card.
Banner button	`banner-button-text`	Button label, up to 25 characters.
Button link	`banner-button-url`	Ordinary URL or deep-link.
Banner background	`banner-bg-color`	Color as `#RRGGBB`.
Button color	`banner-button-color`	Color as `#RRGGBB`; the app selects the text color automatically.

Announcement and banner text support up to five lines and 500 characters in the portal. Colors require six hexadecimal digits: short forms and color names are not accepted.

Contacts and subscription access¶

Field	Key	Purpose
Support link	`support-url`	Link for contacting support.
Support email	`support-email`	Email support button on the subscription card.
Subscription access in the app	`hide-settings`	Controls visibility of the subscription address and related actions.

Subscription access has special states:

Hide (1) hides the subscription address, link copying, config viewing and address editing. Connections, servers, statistics and profiles remain available.
Show (0) restores access and unlocks the imported link if it was locked.
Do not send supplies no value; it does not automatically undo an existing hidden state.

To undo previously configured hiding, explicitly choose Show. See Hiding the subscription URL.

Example: a shared setting with one exception¶

Verify your subscription domains under Domains.
In Client settings, enable global TLS fragmentation and save.
For a domain that does not need fragmentation, open Settings, select disabled and save.
Leave other domains on Inherit to use the shared enabled value.
Check a test device; reconnect to apply connection-related changes.

To temporarily remove the exception, disable that domain's settings level. It inherits global values again. Enable the level to restore the exception.

Domains, migrations and backup addresses¶

Two verification methods are available:

DNS TXT: add the record shown in the portal and press Check. Cloudflare can add the record automatically after you grant permission.
HTML file: place the generated smproxy-verify.html on the required host. This verifies that exact host, rather than the parent domain or neighboring subdomains.

Verify a host with an HTML file¶

Use this method when you can upload a file to the website but cannot edit DNS records.

Open Domains and select HTML-file verification.
Add the exact subscription host, such as sub.example.com.
Download smproxy-verify.html from the portal. Keep its generated <meta> verification token unchanged.
Place it at the website root, accessible at https://sub.example.com/smproxy-verify.html without login.
Check that the server returns that file, rather than a login page, placeholder or redirect to another host.
Press Check in the portal. Successful verification shows the verified status and exact-host scope.

Verification tries HTTPS with a valid certificate first, then HTTP if HTTPS retrieval fails. If the file is found but its token does not match, download the current file from the portal and replace the old content.

Verifying sub.example.com by file does not verify example.com, other.example.com or subdomains below sub.example.com. Verify each additional host separately. Use DNS TXT to cover the parent domain and its subdomains.

Migrations and fallbacks¶

For verified domains, you can configure:

Migration: an old-to-new address rule using new-domain.
Domain backup addresses: fallback addresses for subscriptions on that domain.
Global subscription backup domains: configured in global client settings and appended after each domain's own backup addresses. Only verified domains belonging to your account are accepted.

Migration changes the primary address; fallback supplies an alternative when the primary cannot be reached. See Domain verification and Moving users to another domain.

Statistics¶

View daily, weekly and monthly charts, new and returning devices, and filters by period, OS, model, HWID and new devices only.

A device is new within a particular provider's account, based on its first appearance there. A device previously used with a different provider can therefore be new to your service. The new-device label relates to the selected period, or the current day when no date filter is selected.

The table includes OS, model, app version, last activity and subscription identifier where available. Open a device's HWID history or subscription update log for more detail. Available information depends on the app version; a missing value alone does not indicate a fault.

Statistics are not your VPN panel's billing records or an availability check for every VPN server.

Messages¶

Create an in-app message with a title, text, type, link and notification option. This is not an email or Telegram broadcast.

Select recipients using your provider's users, a specific HWID, a subscription domain or known subdomain, platform, an app build-number condition, or interface language.

For DNS-verified domains, *.example.com targets the domain and its subdomains. For an HTML-verified host, select the exact host.

The form also offers a message ID and date. The date belongs to the message and does not itself guarantee delivery at a scheduled time. The message appears when received by the app.

An account-specific sending interval applies to ordinary providers, including targeted messages; do not assume a single fixed limit for every account. See Messages & notifications.

Account and security¶

Register with email, sign in with email/password or Google, and recover your password by email.

Under Account, you can set a custom Provider ID, enable TOTP two-factor authentication, obtain backup codes, disable 2FA with confirmation, edit your service description, upload a logo or use an image URL, set website and Telegram links, and enter a Telegram channel title and description.

Save backup codes separately when shown during setup. Each code is single-use. With 2FA enabled, TOTP is also required after Google sign-in.

The interface recommends a square 512×512 logo in PNG/JPG/GIF.

The provider account profile and subscription-card appearance are separate: description and logo belong under Account, while subscription-card fields belong under Client settings.