Learning center

Video Tutorials

Step-by-step video guides

Learn HTTP Tweak at your own pace

Choose a lesson, follow along in the focused player, and keep track of what you have completed on this device.

26Lessons
3Topics
0Completed
Lesson 8 App 7 minutes

HTTP Tweak App: Import & Export Configurations

Import and export configurations and understand the sharing options.

Field reference

Configuration field reference

Use these quick-reference tables when you need the exact meaning, format, or sample value for a Panel field.

Configuration Global Settings

Field Description Sample
Name The unique name for your configuration. My Premium Config
Config Key Read-only key used for cloud import. AB12CD34EF56...
Mobile Locked Config can be used only on mobile data connection. Enabled / Disabled
Block Root / Jailbreak Blocks rooted Android devices and jailbroken iPhones. Enabled / Disabled
Store Install Allow only official store installs (Google Play on Android, App Store on iPhone). Enabled / Disabled
Unlock All Transfers ownership to the importing device after import checks pass and disables the other restrictions. Enable it only when full ownership transfer is intended. Enabled / Disabled
Unlock Server Allow users to change server in the app. Enabled / Disabled
Unlock Server Credentials Allow users to edit username and password. Enabled / Disabled
Unlock Proxy Allow users to edit proxy settings. Enabled / Disabled
Unlock Payload Allow users to edit payload/SNI. Enabled / Disabled
Share Resources Expose this configuration's servers and tweaks to other configs. Enabled / Disabled
Show Shared Resources Enable this to display servers and tweaks shared by other configurations. Enabled / Disabled
Custom Resources Enable this to allow non-owner users to add local custom servers and tweaks for this configuration only. Enabled / Disabled
Allow Config Resharing When enabled, people you share this config with can export and re-share it. When disabled, recipients can use it but cannot re-share. Enabled / Disabled
Hide SSH Banner Suppress the SSH server banner shown during connection. Enabled / Disabled
Expire Date Optional date when the configuration stops working. 2025-12-31
Block Application Android only. Not enforced on iPhone. App display names or Android package names to block, separated by new lines or semicolons. Matching is case-insensitive. WhatsApp;com.app.two
Password Import password when Cloud is off. securePass123
Cloud Password Manage passwords in the Access tab; this disables the Password field. Enabled / Disabled
Device ID Lock Restrict to specific device IDs (semicolon-separated). A1B2...;C3D4...
Cloud Device IDs Manage Device IDs in Access tab; disables Device ID Lock. Enabled / Disabled
Update URL Manual update URL when Cloud is off. config.ht
Cloud Update URL Use cloud-managed Update URL; disables manual URL. Enabled / Disabled
App Device ID Device ID allowed to edit this config. 7F3A...32CHARS
Message HTML message shown inside the app. <b>Welcome</b>

Configuration Message Placeholders

Use these tokens in the configuration Message field. The saved template stays unchanged; current values are inserted whenever the configuration is exported, downloaded, or fetched by the app.

  • {config_name} — Configuration name.
  • {created_at} — Creation date and time in YYYY-MM-DD HH:mm:ss format.
  • {created_date} — Creation date in YYYY-MM-DD format.
  • {updated_at} — Last-updated date and time in YYYY-MM-DD HH:mm:ss format.
  • {updated_date} — Last-updated date in YYYY-MM-DD format.
  • {server_count} — Number of servers included in the generated configuration.
  • {tweak_count} — Number of tweaks included in the generated configuration.
  • {server_list} — Server names in alphabetical order, separated by commas.
  • {tweak_list} — Tweak names in alphabetical order, separated by commas.

Placeholders are case-sensitive. Unknown placeholders remain unchanged. Empty server or tweak lists resolve to an empty string.

Example saved message 
Last updated: {updated_at}
Servers ({server_count}): {server_list}
Tweaks ({tweak_count}): {tweak_list}

The date and time and the alphabetically ordered resource names are refreshed in the generated message without a worker rewriting the saved template.

Server Settings

Select one tunnel family and one tunnel option. SSH: Default, BHTTP, HCR, SlowDNS or Slipstream. OpenVPN: TCP, UDP, SlowDNS or Slipstream. Nothing is selected automatically; SlowDNS and Slipstream use TCP internally. V2Ray also requires its protocol type. The server carrier must match the tweak.

Supported Methods lists exact allowed combinations. New servers accept all eligible methods; tap the summary pill to choose combinations, then Save. Select at least one method, or choose Direct explicitly. Direct means none of Payload, Proxy or TLS. Connection values, bug host and BHTTP/HCR settings are encrypted. Tunnel selections and enabled-option markers remain public for filtering. Non-owners can edit only fields permitted by the configuration: Unlock Payload for payload, SNI, TLS, resolver, KCP and bug host; Unlock Proxy for proxy; Unlock Server for server values. Certificate verification follows the client settings.

Slipstream uses the same compatible stream families as SlowDNS. Domains and an optional PEM certificate belong to the server. Resolver IPs, optional ports, authoritative paths and keep-alive belong to the tweak. Keep-alive defaults to 400 ms and 0 disables it. Payload and TLS run inside the DNS tunnel; Proxy is unavailable.

Common Fields
Field Description Sample
Name Label for the server. SG Premium 1
Tunnel Type Protocol used for connection. OpenVPN, SSH, BHTTP, HCR, SlowDNS, Slipstream, UDP Hysteria, V2Ray
Category Used to match tweaks and servers, aside from the tunnel type. WS, CF, GCP, Free, Paid, etc.
Note Optional note for your reference. Singapore backup
OpenVPN Specific
Field Description Sample
Type Connection mode. TCP, UDP, SlowDNS, Slipstream
Server / Credentials TCP/UDP use hosts:ports@username:password. SlowDNS and Slipstream use the same combined field as SSH. The app removes the OpenVPN remote for those carriers. host1;[2001:db8::1]:1194;80@username:password
nameserver1;nameserver2@username:password
domain1;domain2@username:password
SSL Port TLS port for OpenVPN. Use 443 or 443;444. One port is selected when connecting. The profile remote line keeps one port. 443 or 443;444
OpenVPN Config Certificates and options only. Import .ovpn extracts remote entries into Server and prepares options for OpenVPN 3. client
dev tun
remote-cert-tls server
Private Key Password Optional password for the private key embedded in the OpenVPN profile. settings.private_key_password
SSH Specific
Field Description Sample
Server SSH host list and credentials. Separate hosts with semicolons. The port may be one value or a list such as 443;444. One host and one port are selected separately. host1;host2:22@username:password
host1;host2:443;444@username:password
IPv6 Host Format Wrap each IPv6 host in brackets, then add the shared port like normal host:port. [ipv6:1];[ipv6:2];[ipv6:3]:port
SSL Port TLS port for SSH. Use 443 or 443;444. One port is selected when connecting. 443 or 443;444
Private key Optional private key. -----BEGIN PRIVATE KEY-----...

Select one tunnel family and one tunnel option. SSH: Default, BHTTP, HCR, SlowDNS or Slipstream. OpenVPN: TCP, UDP, SlowDNS or Slipstream. Nothing is selected automatically; SlowDNS and Slipstream use TCP internally. V2Ray also requires its protocol type. The server carrier must match the tweak.

SSH ➜ BHTTP / HCR
Field Description Sample
Server * SSH host list and credentials. Separate hosts with semicolons. The port may be one value or a list such as 443;444. One host and one port are selected separately.
Relay listener port; not the backend SSH port.		 host1;host2:22@username:password
BHTTP: host1;host2:8081@username:password
HCR: host1;host2:8880@username:password
IPv6 Host Format Wrap each IPv6 host in brackets, then add the shared port like normal host:port. [2001:db8::1];[2001:db8::2]:8880@username:password
Private key (optional) Optional private key. -----BEGIN OPENSSH PRIVATE KEY-----...
V2Ray Specific
Field Description Sample
Type V2Ray mode. VLESS, VMess, Hysteria2, Socks, HTTP, Shadowsocks, Trojan, WireGuard
V2Ray Configuration Full JSON configuration or V2Ray URI. vmess://... or {"outbounds": [...]}

OpenVPN SlowDNS uses TCP through DNSTT. Add the nameserver and public key to the server, and the resolver to the matching tweak. The DNSTT server must forward to an OpenVPN TCP service. Payload, SNI and TLS are optional; remote proxy is not supported.

Select a protocol pill, or select both OpenVPN TCP and SSH, or both OpenVPN SlowDNS and SSH SlowDNS. Selected pills show a checkmark. Each server uses one protocol; a shared tweak works with either compatible server.

SlowDNS (Server)
Field Description Sample
Nameservers & credentials DNS servers and credentials. nameserver1;nameserver2@username:password
SlowDNS Public Key Public key for the server. 1234abcd...
UDP Hysteria Specific
Field Description Sample
Server and Authentication Auth may be used alone or followed by OBFS. Separate multiple hosts with semicolons; one host is selected when connecting. Commas join ports and ranges for hopping, for example 443,500-3445. Semicolons or newlines separate choices: 443,500-3445;3000-4000,4500-5000;5670. One choice is selected per connection; hopping uses only that choice. hy.example.com:443@my-auth
hy1.example.com;hy2.example.com:443@my-auth:my-obfs
hy.example.com:443,1000-2000@my-auth
hy.example.com:443;444@my-auth
Upload:Download Single bandwidth field using Upload:Download format. 100:100
ALPN Optional. Blank by default. h3
Port Hopping Interval Optional seconds value. Blank values use the app fallback of 10. 10
Allow Insecure Certificate-verification setting, enabled by default. true

Tweak Settings

Select one or more tunnel families and their allowed server variants. Each family needs a non-empty variants array. The tweak does not use one tunnel name or a per-tweak version field. Multiple tunnels are alternative compatible servers. The client connects through one selected server at a time.

Enable Payload, Proxy and TLS independently. Only options and methods compatible with every selected tunnel remain available. In JSON, carrier selects default, slowdns or slipstream; carrier.settings holds its settings. methods: {} means Direct. Add a methods object entry to enable that method. On update, supplied tunnels, carrier and methods objects replace their corresponding objects; omitted objects keep their saved values. Payload, TLS and Proxy need compatible stream variants; UDP Hysteria supports TLS for SNI only. SlowDNS and Slipstream work with SSH Default, OpenVPN TCP and compatible V2Ray RAW/TCP profiles. OpenVPN UDP, SSH BHTTP/HCR and V2Ray Hysteria2/WireGuard cannot use these carriers or stream methods. V2Ray profile TLS remains independent. Bug host is independent of connection options.

SlowDNS settings are shared by SSH, OpenVPN TCP and compatible V2Ray servers. Configure nameservers and the public key on the server. Payload and TLS run inside the DNS tunnel; remote proxy is unavailable.

Slipstream uses the same compatible stream families as SlowDNS. Domains and an optional PEM certificate belong to the server. Resolver IPs, optional ports, authoritative paths and keep-alive belong to the tweak. Keep-alive defaults to 400 ms and 0 disables it. Payload and TLS run inside the DNS tunnel; Proxy is unavailable.

Supported Methods lists exact allowed combinations. New servers accept all eligible methods; tap the summary pill to choose combinations, then Save. Select at least one method, or choose Direct explicitly. Direct means none of Payload, Proxy or TLS. Connection values, bug host and BHTTP/HCR settings are encrypted. Tunnel selections and enabled-option markers remain public for filtering. Non-owners can edit only fields permitted by the configuration: Unlock Payload for payload, SNI, TLS, resolver, KCP and bug host; Unlock Proxy for proxy; Unlock Server for server values. Certificate verification follows the client settings.

FieldRuleDescription
tunnelsrequired objectSelect one or more tunnel families and their allowed server variants. Each family needs a non-empty variants array. The tweak does not use one tunnel name or a per-tweak version field.
tunnels.openvpn.variantsarray: tcp, udpThe API accepts every listed compatible variant. In the form, choose one shared SSH/OpenVPN tunnel option; selecting another clears the previous choice. SSH Default is explicit and is not selected automatically. SlowDNS and Slipstream need no extra TCP or Default pill. V2Ray requires at least one protocol type.
tunnels.ssh.variantsarray: default, bhttp, hcrThe API accepts every listed compatible variant. In the form, choose one shared SSH/OpenVPN tunnel option; selecting another clears the previous choice. SSH Default is explicit and is not selected automatically. SlowDNS and Slipstream need no extra TCP or Default pill. V2Ray requires at least one protocol type.
tunnels.v2ray.variantsarray: vless, vmess, trojan, ss, socks, http, hysteria2, wireguardThe API accepts every listed compatible variant. In the form, choose one shared SSH/OpenVPN tunnel option; selecting another clears the previous choice. SSH Default is explicit and is not selected automatically. SlowDNS and Slipstream need no extra TCP or Default pill. V2Ray requires at least one protocol type.
tunnels.hysteria.variantsarray: defaultUDP Hysteria supports SNI through TLS. Its QUIC connection uses TLS 1.3; the tweak does not select a TLS version.
tunnels.v2ray.bug_hostsstring array, one candidate per entry, max 253Replaces [bughost] in the server profile.
carrier.typerequired: default, slowdns, slipstreamSelect one carrier.
carrier.settingsrequired objectSettings for the selected carrier; empty for default.
methodsrequired objectEnable Payload, Proxy and TLS independently. Only options and methods compatible with every selected tunnel remain available. In JSON, carrier selects default, slowdns or slipstream; carrier.settings holds its settings. methods: {} means Direct. Add a methods object entry to enable that method. On update, supplied tunnels, carrier and methods objects replace their corresponding objects; omitted objects keep their saved values.
methods.payload.valuestring, required when enabledPayload
methods.tls.snistring array, required when enabled, one candidate per entry, max 253SNI
methods.tls.versiondefault, TLSv1.1, TLSv1.2, TLSv1.3Controls the outer TLS connection. V2Ray profile TLS settings remain independent.
methods.proxy.hostsstring array, required when enabled, one candidate per entry, max 253Enable Proxy independently from Payload. Proxy alone uses a normal CONNECT request; enable Payload to customize it. Unavailable with SlowDNS or Slipstream. The form accepts host:port@username:password, multiple hosts separated by semicolons, and a port list such as 8080;8081. One proxy host and one proxy port are selected when connecting.
methods.proxy.portsinteger array, for example [443, 444], required when enabledEnable Proxy independently from Payload. Proxy alone uses a normal CONNECT request; enable Payload to customize it. Unavailable with SlowDNS or Slipstream. The form accepts host:port@username:password, multiple hosts separated by semicolons, and a port list such as 8080;8081. One proxy host and one proxy port are selected when connecting.
methods.proxy.credentialsoptional username and passwordEnable Proxy independently from Payload. Proxy alone uses a normal CONNECT request; enable Payload to customize it. Unavailable with SlowDNS or Slipstream. The form accepts host:port@username:password, multiple hosts separated by semicolons, and a port list such as 8080;8081. One proxy host and one proxy port are selected when connecting.
carrier.settings.resolversstring array; SlowDNS requires resolvers; Slipstream requires resolvers and/or authoritative pathsFor SlowDNS: plain IP or udp:// for DNS, https:// for DoH, tls:// or dot:// for DoT. For Slipstream: IP addresses with optional ports, for example 1.1.1.1:5353;8.8.8.8. Bracket IPv6 with a port. Port defaults to 53. The form accepts semicolon-separated values; JSON uses an array. SlowDNS/Slipstream resolvers: [local] uses the current network DNS on each connection. Mix with fixed values: [local];8.8.8.8. Optional port: [local]:5353. SlowDNS also accepts udp://[local]. Resolver fields only.
carrier.settings.kcp_windowSlowDNS only: integer, 1–4096; default 512KCP window size
carrier.settings.congestion_controlSlipstream only: bbr or dcubicSlipstream uses the same compatible stream families as SlowDNS. Domains and an optional PEM certificate belong to the server. Resolver IPs, optional ports, authoritative paths and keep-alive belong to the tweak. Keep-alive defaults to 400 ms and 0 disables it. Payload and TLS run inside the DNS tunnel; Proxy is unavailable.
carrier.settings.authoritativeSlipstream only: optional IP[:port] array; at least one resolver or authoritative address is requiredSlipstream uses the same compatible stream families as SlowDNS. Domains and an optional PEM certificate belong to the server. Resolver IPs, optional ports, authoritative paths and keep-alive belong to the tweak. Keep-alive defaults to 400 ms and 0 disables it. Payload and TLS run inside the DNS tunnel; Proxy is unavailable.
carrier.settings.keep_alive_msSlipstream only: integer milliseconds, 0–65535; default 400Slipstream uses the same compatible stream families as SlowDNS. Domains and an optional PEM certificate belong to the server. Resolver IPs, optional ports, authoritative paths and keep-alive belong to the tweak. Keep-alive defaults to 400 ms and 0 disables it. Payload and TLS run inside the DNS tunnel; Proxy is unavailable.
tunnels.ssh.bhttp.version ssh_bhttp
nullable|integer|between:1,2 		Version
Defaults to 2
tunnels.ssh.bhttp.chunk_size ssh_bhttp
nullable|integer|between:64,1399 		Download record size (64–1399 bytes)
Defaults to 1399
tunnels.ssh.bhttp.download_batch ssh_bhttp
nullable|integer|between:1,32 		Download batch (1–32 records)
Defaults to 8
tunnels.ssh.bhttp.upload_workers ssh_bhttp
nullable|integer|between:1,64 		Parallel uploads (1–64)
Defaults to 2
tunnels.ssh.bhttp.download_workers ssh_bhttp
nullable|integer|between:1,128 		Parallel downloads (1–128)
Defaults to 4
tunnels.ssh.hcr.download_batch ssh_hcr
nullable|integer|between:1,32 		Download batch (1–32 records)
Defaults to 32
tunnels.ssh.hcr.upload_workers ssh_hcr
nullable|integer|between:1,64 		Parallel uploads (1–64)
Defaults to 16
tunnels.ssh.hcr.download_workers ssh_hcr
nullable|integer|between:1,128 		Parallel downloads (1–128)
Defaults to 32
tunnels.ssh.hcr.mode ssh_hcr
nullable|in:hcr_v1,hcr_v1_plain 		messages.ssh_hcr
hcr_v1: TLS; hcr_v1_plain: Plain transport
Defaults to hcr_v1

V2Ray with payload, TLS and proxy

Enable Payload, Proxy and TLS independently. Only options and methods compatible with every selected tunnel remain available. In JSON, carrier selects default, slowdns or slipstream; carrier.settings holds its settings. methods: {} means Direct. Add a methods object entry to enable that method. On update, supplied tunnels, carrier and methods objects replace their corresponding objects; omitted objects keep their saved values.

Payload, SNI and proxy tweaks require RAW/TCP on the V2Ray server. TLS in the tweak wraps the connection to the proxy or server; TLS in the server profile is independent.

Supported: VLESS, VMess, Trojan, Shadowsocks, SOCKS and HTTP over RAW/TCP. Injection is unavailable with WebSocket, gRPC, Hysteria2 or WireGuard.

  1. Add a V2Ray server with your JSON/URI, then a tweak of the same type and category. Select both in an updated Android or iOS client and connect.
  2. Fill only the fields needed below. Empty strings disable them. sni enables outer TLS; tls_version alone does not. Without payload, proxy uses HTTP CONNECT.
  3. For shared configs, unlock_payload permits edits to payload, SNI, TLS version and bug_host; unlock_proxy permits proxy edits; unlock_server permits server edits. These flags do not change the owner’s access.
Type methods.payload.value methods.tls.sni methods.proxy
Direct — — —
Direct Payload GET-RAY /[port]/ HTTP/1.1[crlf]Host: [host][crlf][crlf] — —
TLS/SSL — edge.example.com —
TLS/SSL Payload GET-RAY /[port]/ HTTP/1.1[crlf]Host: [host][crlf][crlf] edge.example.com —
HTTP Proxy — — proxy.example.com:8080
Payload + HTTP Proxy GET-RAY /[port]/ HTTP/1.1[crlf]Host: [host][crlf][crlf] — proxy.example.com:8080
TLS/SSL Proxy — edge.example.com proxy.example.com:443
TLS/SSL Payload + HTTP Proxy GET-RAY /[port]/ HTTP/1.1[crlf]Host: [host][crlf][crlf] edge.example.com proxy.example.com:443

methods.tls.version: default, TLSv1.1, TLSv1.2, TLSv1.3.

methods.proxy: {"hosts":["proxy.example.com"],"ports":[443],"credentials":{"username":"username","password":"password"}}. The editor still accepts proxy.example.com:443@username:password and stores that object. Separate extra hosts with a newline or semicolon. A semicolon inside [rotate=a;b] stays part of that one candidate.

Replace sample hosts and credentials. GET-RAY requires a compatible relay that returns HTTP 101/2xx and forwards raw traffic to the backend. Configure server-profile TLS to match that backend. A normal website is insufficient.

Client API · Business API

Payload & server placeholders

Keep connection placeholders as literal strings in Client API and Business API requests. The app resolves them when connecting, using the selected server, tweak, proxy, and network. They are field-specific: a token supported in a payload is not automatically supported in a server address or SNI.

Where placeholders work

Field Supported use
Tweak methods.payload.value HTTP payload tokens and controls described below, on a compatible payload connection
Tweak methods.proxy.hosts [host] reuses the selected server host; supply the proxy port separately in methods.proxy.ports
SSH/OpenVPN tweak methods.tls.sni [host] uses the selected server host; [proxy] uses the proxy host without its port
UDP Hysteria tweak methods.tls.sni Host tokens such as [host], [ip], [ssh_host], [rlb], [bughost], and [cf], including uppercase forms; [proxy] is not supported because UDP Hysteria has no tweak proxy
V2Ray server settings.profile [bughost] uses a selected value from the tweak's tunnels.v2ray.bug_hosts
SlowDNS/Slipstream tweak carrier.settings.resolvers [local] uses the current network's DNS address

Use actual hostnames or IP addresses in server endpoint arrays. For V2Ray SNI and proxy fields, use explicit host values unless the chosen connection supports the desired substitution. See connection examples for compatible methods.

Payload tokens

The following reference describes SSH/OpenVPN payload connections. Use the spelling shown; do not assume every token accepts mixed or uppercase spelling.

Token Replacement / example
[host], [ip], [ssh_host] Destination host, for example ssh.example.com; [ip] does not force a DNS lookup
[port], [ssh_port] Destination port, for example 22
[host_port], [ip_port], [ssh] Destination host and port, for example ssh.example.com:22; IPv6 is bracketed
[proxy] Selected proxy address, including its port when supplied, for example proxy.example.com:8080
[proxy_host], [proxy_port] Proxy host and port separately; use [proxy_host] when a header needs only the hostname
[bughost], [rlb], [cf] Aliases for the destination host in these payloads; the V2Ray profile substitution is separate
[method], [protocol] Connection request method and HTTP version; these depend on the connection path
[raw], [real_raw] Connection request line followed by a blank line
[crlf], [cr], [lf], [lfcr] CR+LF, CR, LF, or LF+CR; normal HTTP headers use [crlf]
[ua] The client's user-agent value; it can differ between connection paths
[auth] Proxy authorization derived from configured proxy credentials; leave credentials in methods.proxy.credentials

For a compatible HTTP CONNECT proxy, this tweak method fragment targets the selected server. The proxy must permit that destination and port.

{
  "methods": {
    "proxy": {"hosts": ["proxy.example.com"], "ports": [8080]},
    "payload": {
      "value": "CONNECT [host_port] HTTP/1.1[crlf]Host: [host_port][crlf][crlf]"
    }
  }
}

V2Ray payload examples use [host], [port], [ua], and [crlf] for the payload destination. A profile's [bughost] is resolved from tunnels.v2ray.bug_hosts before connecting; it is not a universal replacement for every payload token. Use the V2Ray payload example with a compatible RAW/TCP profile and frontend.

Payload choices and write controls

These controls apply to SSH/OpenVPN payload connections. Choices select text; write controls divide the outgoing stream. A write boundary does not guarantee a separate TCP packet.

Syntax Behavior
[rotate=one.example;two.example] Cycles through alternatives on successive uses; rotation state can reset when the connection restarts
[random=one.example;two.example] Chooses one alternative randomly
[split] Splits writes and adds a one-second pause after the complete payload
[splitNoDelay], [instant_split] Splits writes without an added pause
[delay], [delay_split], [split_delay] Splits writes and pauses one second at that boundary

Keep the semicolons inside a choice token. API host and resolver candidates are separate JSON array entries, not one semicolon-separated string.

Local DNS resolver

Use lowercase [local] only in SlowDNS or Slipstream resolver fields. The app discovers the current network's DNS address for each connection and keeps the placeholder in the saved configuration. It does not mean localhost, the VPN server, or the panel server's DNS.

Value Use
[local] Network DNS with the default DNS port, 53
[local]:5353 Network DNS with an explicit port
udp://[local], udp://[local]:5353 SlowDNS UDP resolver forms; use the plain forms for Slipstream

In the panel resolver input, you can enter [local];8.8.8.8. In either API, send separate array values:

{
  "carrier": {
    "type": "slipstream",
    "settings": {"resolvers": ["[local]", "8.8.8.8:53"]}
  }
}

This is a tweak carrier fragment. [local] is not supported in Slipstream carrier.settings.authoritative, server DNS domains/nameservers, payloads, SNI, or ordinary server endpoint fields. If network DNS cannot be discovered when required, the app reports that local DNS is unavailable; adding a fixed resolver does not guarantee automatic fallback.

Configuration message placeholders

Connection tokens are separate from configuration message templates such as {config_name}. Message templates are rendered by the panel. See configuration message placeholders and the message reference in the tutorial.

Client API · Business API