Two Key Android Settings for Clash: VpnService Authorization and Battery Whitelist

Clash on Android relies on VpnService for its local tunnel. Authorization prompts, background kills, and per-app proxying are the three most common headaches. This article explains how authorization works and how to whitelist the app in battery managers on major OEM skins.

Why Clash on Android always shows an authorization prompt

On Windows and macOS, the Clash client intercepts traffic through system proxy settings or a TUN virtual adapter. Android, for security reasons, blocks that path entirely — ordinary apps have no permission to read or write network interfaces directly. Instead, the system offers an official channel called VpnService. Any app that wants to take over global traffic — not just proxy tools, but also legitimate enterprise VPNs and parental control software — must request user authorization through this interface.

So the first time you open Clash on Android and start the proxy, the system pops up a dialog along the lines of "Connect to VPN? This app wants to set up a VPN connection that monitors network traffic." This isn't Clash's own behavior — it's Android's mandatory prompt for the VpnService interface, and no app using this technical route can bypass it. Only after tapping "OK/Allow" does the system assign a virtual network interface, letting Clash pull device traffic into the kernel for rule-based routing.

Once granted, as long as you don't uninstall/reinstall or clear app data, the system usually remembers the choice and won't prompt again on later launches. If you're getting re-prompted every time you turn on the proxy, it's likely that a battery manager is clearing the app's state in the background, or a system update reset the VPN permission record.

What to do if the prompt doesn't appear or tapping does nothing

On some devices the prompt flashes and disappears, or never shows at all, or the proxy toggle looks "on" but traffic isn't actually going through it. Check these in order:

• Check for another active VPN connection. Android only allows one VpnService instance at a time. If an enterprise VPN, another proxy tool, or a "Private DNS" feature requiring a virtual adapter is already active, Clash's tunnel will be bumped or fail to establish — the system's "VPN" list shows who's currently holding it.
• Make sure it isn't blocked by app locking or permission management. Some custom OS builds list the VPN permission separately from ordinary network permissions, under a privacy management section. You may need to manually enable "VPN service" or "Set up VPN connection" there.
• Reinstall the app and clear all data, then try again. If the permission record got corrupted, redoing the authorization flow usually fixes it. Export your subscriptions and custom rules first so you don't lose your configuration.
• Switch to system proxy mode to verify. If the client supports both TUN mode and the traditional system proxy mode, try system proxy mode first to confirm the subscription and nodes work, then go back and troubleshoot VpnService authorization in isolation.

Why the app still gets killed even after whitelisting

The tunnel created by VpnService is a long-running background process. Android's battery management treats processes that stay out of the foreground for a while as "suspicious background activity" and reclaims them — a policy that's especially aggressive on Chinese OEM skins. In practice this shows up as: the proxy dropping after the screen is locked for a while, the network falling back to a direct connection a few minutes after switching to another app, or the process being silently killed overnight or during long idle periods.

To keep the tunnel alive, the core idea is to make the battery optimization policy "ignore" the app, or explicitly tell the system it's exempt from power-saving limits. This usually requires two separate settings, and both matter:

1. System-level battery optimization whitelist. Most Android systems have a "Battery optimization," "Power usage," or "Smart app management" section — find the Clash client there and choose "Don't optimize" or "Allow background activity."
2. OEM-specific power manager whitelist. This is an extra layer added by Chinese OEM skins, separate from the stock battery optimization mechanism, and must be allowed independently. The next section lists the exact path for each major brand.

Whitelist paths on major OEM Android skins

Menu names and hierarchy vary slightly by brand. The paths below reflect common locations on current mainstream versions. If the wording doesn't match, searching "battery," "power saving," or "auto-start" in the settings search box usually finds it fast.

Xiaomi / Redmi (MIUI / HyperOS)

Settings → App settings → Manage apps → find the Clash client → set power saving to "No restrictions"; also go to Settings → Battery & performance → App battery saver and disable the "Memory and background usage management" restriction for the app. Both need to be allowed for stable background residency.

Huawei (HarmonyOS / EMUI)

Settings → Battery → More battery settings → App launch, turn off automatic management for the Clash client and manually enable "Allow auto-launch," "Allow secondary launch," and "Allow running in background"; some devices also require separately disabling "Smart power saving" restrictions for the app outside the app launch manager.

OPPO (ColorOS)

Settings → Battery → App battery usage, find the app and choose "Allow background running"; then go to Settings → App management → App launch management, switch to manual management, and enable all three toggles (auto-launch, secondary launch, background running).

vivo (OriginOS / Funtouch OS)

i Manager → Power management → High background power consumption, add the Clash client to the list allowed to run at high background power; then go to Phone Manager → App management → Permission management → Auto-start management and enable auto-start for the app.

Samsung (One UI)

Settings → Battery and device care → Battery → Background usage limits, remove the app from the "Sleeping apps" and "Deep sleeping apps" lists, and confirm it isn't included in "App standby" restrictions. Samsung's power-saving policy is relatively lenient, so this one step is usually enough.

Per-app proxying: choosing which apps go through the tunnel

Besides establishing the tunnel, Android's VpnService also lets the client specify which apps' traffic gets proxied and which bypasses it directly — this is per-app proxying (some clients call it an "app whitelist" or the reverse "app blacklist" mode). A typical use case: route only the browser and a few specific apps through the proxy while keeping banking and payment apps on a direct connection, or the reverse — exclude only a few proxy-sensitive apps.

Two things to keep in mind when setting up per-app proxying: first, whitelist mode and blacklist mode are mutually exclusive — only one is active at a time, and picking the wrong mode means the apps you meant to proxy don't get proxied (or vice versa); second, after changing the app list you usually need to restart the proxy service for it to take effect, since the system's VpnService tunnel parameters are written once when the connection is established and don't hot-reload mid-session.

If you just want to quickly verify whether a given app is going through the proxy, you don't need the per-app feature at all — just check the client's connection logs or the traffic panel for that app's domain requests, which is far more direct than repeatedly tweaking the list.

A combined troubleshooting checklist

Putting all of the above together, the recommended troubleshooting order for unstable proxying on Android is: first confirm VpnService authorization actually succeeded (check whether the system's VPN list shows an active connection icon); then confirm no other app is holding the same VpnService slot; next go through both whitelist layers — system battery optimization and the OEM power manager; finally, if per-app proxying is in use, check whether the mode and list match what you expect. These four steps cover the vast majority of "installed but unstable" cases on Android, far more efficiently than blindly reinstalling or switching clients.