clod-* headers

Only Clod Clash understands clod-*. The panel does not send them by itself — add them in the subscription settings under customResponseHeaders. Each one works only within its own subscription.

All headers

Instead of true / false you can use 1 / 0, yes / no, on / off — except for clod-disable-ping, clod-hide-badges, clod-16-20-check and clod-move-sub, which accept only true. A value that is not understood counts as no header. Send non-ASCII text as base64:<text in base64>.

clod-* headers that work on desktop only are not listed here — Android does not understand them.

Provider links

“Customer portal”, “Support” (support-url), “Bot”, “Server status” and “Setup guide” are gathered in a block named after the subscription at the top of the More tab. Only the links that were sent are shown; with none, there is no block. “Customer portal” and “Support” also appear on the subscription card when expiry is near or has passed.

Announcement and promo

• clod-announce — a permanent announcement on the home screen, shown while the panel sends it.
• clod-promo — a banner for offers under the announcement, collapsed to two lines. It can be closed with a cross; a new text brings it back, and without the header it disappears with the next update. clod-promo-url makes it clickable.
• Length — up to 300 visible characters.
• Words can be coloured: a #RRGGBB code right before a word, for example #EF4444IMPORTANT: node under maintenance. The colour lasts until the next space and does not count towards the length.

Routing mode: clod-lock-mode

Locks the mode to the one in the template's mode: (without it — “Rule mode”). The mode row says “set by your provider” and the mode cannot be changed.

For compatibility with Prizrak-Box, global-mode: false is read as clod-lock-mode: true and global-mode: true as “no lock”. clod-lock-mode wins.

Latency

• clod-ping: A/B — up to A ms latency is green, up to B yellow, red beyond. Two integers separated by /, 1 ≤ A < B ≤ 60000, otherwise the header is skipped.
• clod-disable-ping: true — on the home screen and the Servers tab a check mark (the server answers), a cross (it did not) or a dash (not checked yet) instead of milliseconds.

The 16–20 check: clod-16-20-check

With true the app checks every server of the subscription on the user's network itself: it downloads 64 KB through the server and looks at one thing only — whether all of it arrives or the download stops after the first kilobytes. A server where it stopped is checked twice more a few seconds later, together with a server that works on this network. The snowflake mark next to the latency in the Servers tab and on the home screen is set only when all three checks were cut while the working server passed; if the last check passed, the server counts as working. With nothing to compare against, or if the working server failed too, no mark is set: that is more likely a bad network. Tapping the mark opens an explanation: check the connection yourself and tell support (the “Contact support” button is there when support-url was sent). The app does nothing to the servers: latency and selection stay as they were. New servers and servers whose connection data changed are checked (address, port, protocol, keys; the TLS server name and Host do not count — they may be handed out at random); results are rechecked every 3 days, and a check that gave no result is retried after 6 hours on the same network. Results are kept per subscription and per network. Without the header (or with any value other than true) there are no checks and no marks.

Servers for the mobile network only: clod-mobile-only

The value is the exact server names separated by |, for example Moscow LTE|MTS Saint Petersburg. Letter case matters; spaces around a name are ignored. A server whose name contains | cannot be listed. The names apply to servers from the subscription and from its server sets alike, including servers a set gets on a later update.

• On the mobile network (the SIM network) these servers are shown as usual, marked “mobile network”.
• On any other network — Wi-Fi (a hotspot from another phone too), cable, USB — they are in no group and not in the server list, cannot be selected and are not checked. A group whose selected server is one of them — or, with nothing selected, whose first server is — uses the first visible server, or else the first group that still has a visible server; never a direct connection. On the mobile network it returns to the selected server by itself.
• Servers that connect through such a server (dialer-proxy) are hidden together with it.
• If only such servers are left in a group, off the mobile network the group lets nothing through rather than sending traffic directly; the list shows “Servers are available only on a mobile network” instead of servers.
• A template rule that names such a server directly still goes through it — servers are hidden from groups only.

Send names with Cyrillic letters or flags as base64 of the whole value: 🇷🇺 Москва LTE|МТС Питер is base64:8J+Ht/Cfh7og0JzQvtGB0LrQstCwIExURXzQnNCi0KEg0J/QuNGC0LXRgA==.

Apps mode: clod-app-mode

There is one value — all (case does not matter); any other value counts as no header.

Right after installation More → Apps is set to “Allow selected apps” with an empty list: unless the subscription sent its own app list, only Clod Clash itself goes through the tunnel. With clod-app-mode: all, while the user has checked nothing, the “Allow all apps” mode applies instead — together with the subscription's tun.include-package and tun.exclude-package as they are. If the subscription has no lists of its own, the screen says under the mode: Until you check anything, the provider’s mode applies — “Allow all apps”.

• The user checked at least one app — the header does not apply, the checked apps go through the tunnel. Checks on apps removed from the phone do not count. Unchecked them all — it applies again.
• The user picked “Allow all apps” or “Deny selected apps” themselves — the header changes nothing.
• The header writes nothing into the user's settings: stop sending it, and after the subscription updates the app's default applies again.
• Which of the traffic sent into the tunnel goes directly is still decided by the template rules.

clod-app-mode: all

The “Allow all apps” mode is not recommended. Better send tun.exclude-package with the apps the VPN gets in the way of (banks, government services): then all apps except the listed ones go through the tunnel even without this header.

Protocol caption under servers: clod-hide-badges

Under a server's name on the Servers tab the app shows its protocol, transport and security — the same way the panel does: VLESS RAW (TCP) · Reality, Trojan WebSocket · TLS, Hysteria2 (UDP). With clod-hide-badges: true this caption is gone, with the tunnel on and off alike.

clod-hide-badges: true

Everything else stays: the server's name and flag, latency, the “mobile network” mark, the snowflake, “Pinned”, and for groups in the list — “Now:” and the server the group uses, or the group type while that server is unknown (with the tunnel on; without it such a group has no caption). The built-in “Direct” and “Reject” inside groups lose their caption too. Captions the provider sets itself stay: the server description (the node's serverDescription field in the template) and the part of the name cut out by ui-subtitle-pattern with the tunnel on. The pattern is a regular expression in the subscription YAML:

clash-for-android:
  ui-subtitle-pattern: "[A-Z]{2}$"

Connections and server selection do not change with the header — only what is shown does.

• When it helps: protocol and security mean nothing to your users or reveal too much, and server names are enough. To still have a line under the name, set serverDescription — for example, For video or Backup.
• The header is read again on every subscription update: true arrives — no caption; the header is gone (or has another value) — the caption is back after the update.
• It works only within its own subscription: other subscriptions keep the caption.
• On desktop the header is the same — clod-hide-badges.

Placeholder nodes: clod-show-0hosts

Without the header the app recognises the panel's placeholder nodes (expired subscription, no traffic left, “no servers”) and shows its own screen with the reason instead. With true the panel's nodes go into the server list as they are. The device limit screen does not depend on this header.

Spare address: clod-new-sub and clod-move-sub

• clod-new-sub — a domain only: backup.example.com, without https://, port, path, ? or #. Anything else is skipped. The spare address is https://, this domain and the path with parameters of the main address: for https://panel.example.com:8443/sub/abc it is https://backup.example.com/sub/abc (the main address's port is not carried over).
• How to write the domain so the app accepts and recognises it:
  • an internationalised domain only in punycode: xn--e1afmkfd.xn--p1ai, not пример.рф;
  • no trailing dot: backup.example.com, not backup.example.com.;
  • letter case does not matter;
  • the spare server answers on port 443.
• Write the domain in the users' subscription links the same way — in punycode and without a trailing dot. Otherwise the app does not recognise the main address's domain in clod-new-sub, takes it for a spare one, and with clod-move-sub “moves” the subscription to the same server.
• The spare address is used only when the main one does not answer. The subscription from it is applied as a normal update. A device limit refusal is not retried on the spare address — it is the same panel.
• Every successful update decides again: the header came — the domain is remembered (a new one replaces the old one), it did not come — there is no spare address any more. The domain of the main address does nothing.
• clod-move-sub: true works only together with clod-new-sub. After an update with it the app checks the spare address. If it returns the subscription, the subscription address changes to the spare one for good and the user sees the notification “The provider updated the subscription address”; server choice, mode and subscription name stay. If it does not answer or refuses, nothing changes, and the next update with this header tries again. On the new address the same header does nothing.
• For a subscription with the secure channel, the spare address and the move go through the same channel: the spare domain must run the same middleware and answer /c1/…. Without it the spare address does not help and the move does not happen.