Users

A user is the account a subscription is built from: access to inbounds through squads, traffic limits, an expiration date, and a device list. The Users section in the panel is the only place where users are created and changed.

Creating a user

Open Users → Create and fill in the fields.

Field	Required	Rules
username	yes	3–36 characters: letters, digits, _, -
expireAt	yes	expiration date, for example 2026-01-17T15:38:45.065Z
status	no	defaults to ACTIVE
trafficLimitBytes	no	limit in bytes; 0 means no limit
trafficLimitStrategy	no	traffic reset period, defaults to NO_RESET
hwidDeviceLimit	no	number of devices; 0 means no limit
tag	no	up to 16 characters: uppercase letters, digits, _
telegramId, email, description	no	notifications and notes
activeInternalSquads	no	the user's internal squads
externalSquadUuid	no	the user's external squad

The panel generates passwords and protocol identifiers (trojanPassword, vlessUuid, ssPassword) itself — you do not need to set them manually.

Statuses

Status	Meaning	How it changes
ACTIVE	access is open	on creation, enable, extension, traffic reset
DISABLED	disabled by an administrator	with the Disable button; back with Enable
LIMITED	the traffic limit is exhausted	automatically by the scheduler
EXPIRED	expireAt has passed	automatically by the scheduler

LIMITED and EXPIRED are not lifted on their own — only by a deliberate action: a traffic reset or an extension of the expiration date. Users can be filtered by status and deleted in groups — Delete users by status.

Traffic limits

trafficLimitBytes is set in bytes; 0 removes the limit. The reset frequency is set by trafficLimitStrategy:

Value	Period
NO_RESET	traffic is never reset
DAY	every day
WEEK	every week
MONTH	calendar month
MONTH_ROLLING	a month from the user's creation date

To reset traffic manually: user card → Reset traffic. The used counter is reset to zero, lastTrafficResetAt is updated, and the LIMITED status becomes ACTIVE. For a group there is a bulk reset — Bulk actions → Reset traffic (up to 500 users at a time).

Expiration date

expireAt is the date after which the user moves to EXPIRED. The Extend button adds days according to the rules:

• EXPIRED — counted from the current moment; the status becomes ACTIVE;
• ACTIVE — days are added to the current expiration date;
• DISABLED and LIMITED — the date is extended, the status does not change.

Bulk extension: Bulk actions → Extend expiration date.

Device limit

hwidDeviceLimit limits the number of devices by HWID. 0 disables the check entirely, and an empty value means "take fallbackDeviceLimit from the subscription settings". For details, see HWID device limit.

Binding to squads

Access to inbounds is defined by internal squads: a user sees only those hosts whose inbounds are part of his squads. An external squad (externalSquadUuid) does not grant anything; it changes the look and behavior of the subscription — templates, headers, HWID settings. Both kinds are covered in Squads.

Subscription links

The link is assembled automatically from SUB_PUBLIC_DOMAIN and the short identifier:

https://sub.example.com/<shortUuid>

It leads to the subscription page or serves the configuration directly. If the link leaks, revoke the subscription (Revoke subscription): the panel issues a new shortUuid and new protocol passwords, and the old link stops working. There is a "passwords only" mode — the short identifier is preserved in that case.

warning

Revoking a subscription cuts off access for everyone who has already imported the old link. Warn the user before you hand out the new one.

tip

The short identifier is generated by the method from SHORT_UUID_METHOD. Do not change it on the fly: it changes the format of all new links. See Environment variables.

What's next

• Squads — how to grant access to inbounds.
• Hosts — what exactly ends up in the subscription.
• HWID device limit — limiting devices.
• API Specification — user management endpoints.