What a subscription link reveals

What the subscription URL, individual server links and connection logs each expose — and the four moments where leaks happen.

Multi-deviceJun 15, 20262 min read

Many people forward a subscription URL like an ordinary link. It is closer to an account password — and the consequences of a leak go beyond someone using your bandwidth.

What the URL contains

Typical structure
https://provider.example/api/v1/client/subscribe?token=UNIQUE_IDENTIFIER

The token is your credential.

Whoever holds it can:

  • Use all your servers and consume your quota.
  • See your plan details — many providers return remaining traffic and expiry in the response headers.
  • Infer your usage — the server list reveals which tier you bought.
  • Keep doing so indefinitely, until you reset it.

The four common leak paths

SituationRiskAvoid it by
Screenshots when asking for helpThe full URL is visibleSwitch tabs first, or redact the column
Online subscription convertersYou hand the URL to a third partySelf-host an open-source converter, or reset afterwards
Committing a config to GitIt stays in history permanentlyAdd config files to .gitignore
Logging into the dashboard on a shared PCBrowser retains the URLClear browsing data afterwards
Subscription URLAccount identity (token)Every server you havePlan and expiry informationStays valid through updatesResetting kills it immediatelySingle server linkThat server's addressUUID or passwordProtocol and transport parametersValid until the operator changes itOnly the provider can revoke itVS
They leak different things

The additional risk with server links is exposing the server address. Widely circulated addresses attract targeted blocking, which is why many providers forbid sharing individual servers.

What your provider can see

Frequently overlooked: there are technical limits on what a provider can observe.

They can seeThey cannot see
Which hostnames you connect to (SNI is visible)The contents of HTTPS pages
Traffic volume and timing patternsPasswords you type, messages you send
Your real IP addressContents of end-to-end encrypted apps
Which servers you use

In other words: HTTPS protects the content, but does not hide who you talked to. That is inherent to any proxy arrangement, not a defect of one provider.

A self-audit list

  1. Does the subscription URL appear in any chat history, email, Git repo or cloud note?
  2. Have you used an online converter? If so, have you reset the URL since?
  3. Do your screenshots redact the subscription column and server labels?
  4. Have you configured it on a shared or borrowed device? Did you clean up?
  5. Is the master password on the password manager holding it strong enough?

If any answer is uncertain, the simplest remedy is to reset the subscription URL and re-enter it on your own devices. It costs a few minutes and invalidates every past leak at once.