VLESS

A protocol the engine speaks. You bring the server.

tunelly is a client. A vless:// share link, a subscription that lists one, or a panel file is enough. The app opens a tunnel to the address in that configuration. We operate no servers and sell no access.

What a link carries

The UUID is the credential. The host and port are the server. The rest of the query string is how the stream is built:

security: reality, tls, or none. REALITY also needs pbk, sni, and usually sid and fp.
flow: xtls-rprx-vision when the server is set for Vision. Ignored on any transport that is not bare TCP.
type: tcp, grpc, ws, httpupgrade, http (HTTP/2), or xhttp.
fp: Which ClientHello to send. The engine has seven recorded browsers. The name in the link is the one that is used.

REALITY

REALITY is a security layer on VLESS, not a protocol of its own. The engine speaks it over TCP, gRPC and XHTTP. A link that pairs it with WebSocket is accepted as TLS instead — that combination is not defined, and the app will not pretend it is.

The public key and the server name have to be present. An empty either is an incomplete record, and import stops.

XTLS Vision

Vision rides on the raw TLS record stream. It only works on bare TCP. A gRPC, WebSocket, HTTP/2 or XHTTP link that still names a flow has the flow dropped, so the node connects rather than failing later.

Vision and mux are not used together. The flow wins.

Transports

Each of these is tested against the servers that produce it.

TCP

The default. An HTTP header on the first exchange is spoken when the profile asks. Other header types are refused.

gRPC

One method, one framing. Multi-mode is a different method and is refused.

WebSocket and HTTPUpgrade

The path is kept whole, query included. Early data is sent only when the profile names it.

HTTP/2 and XHTTP

Both need TLS or REALITY underneath. Cleartext is refused. XHTTP extras that move what the server looks for are refused by name.

What is not carried

KCP is refused. A configuration the engine cannot honour is refused at import, with the reason. VMess, Trojan and the other schemes the phone may open are recognised and then stopped — they are not silent dead entries.

Putting it in the app

Paste the link, or add the subscription address that lists it. How to add a configuration covers the clipboard, a link that does not open the app, and what a refusal looks like.

The same engine also speaks Hysteria2 and WireGuard. If you do not have a configuration yet, where to get servers explains how one reaches you, without naming anyone to buy from.