3x-uiClients
Manage 3x-ui clients — credentials, traffic and expiry limits, IP limits, groups, bulk actions, external links, and online status.
A client is a single user, identified by a unique email. In the current panel, clients are first-class records that can be attached to multiple inbounds at once, with per-client traffic accounting.
Client fields
| Field | Applies to | Meaning |
|---|---|---|
| all | Unique identifier used for accounting and lookups. | |
| ID (UUID) | VLESS, VMess, TUIC | The client credential. |
| Password | Trojan, Shadowsocks, TUIC | The client credential. |
| Auth | Hysteria2 | The client credential. |
| Flow | VLESS | XTLS flow, e.g. xtls-rprx-vision. |
| Limit IP | all (except TUIC) | Max simultaneous source IPs (enforced via Fail2ban). |
| Total (GB) | all (except TUIC) | Traffic quota; the client is disabled when exhausted (for TUIC, limits are set at the inbound level). |
| Expiry | all | Date after which the client stops working. |
| Reset | all | Auto-renew period in days (rolls the quota over). |
| Telegram ID | all | Links the client to a Telegram user for self-service/notifications. |
| Sub ID | all | Subscription identifier grouping this client's links. |
| Group | all | Optional client group for organization and bulk filtering. |
| Comment | all | Free-text note. |
Reaching the traffic or expiry limit disables the client, and a client
disabled or deleted by hand counts too; the panel restarts Xray then
(restartXrayOnClientDisable, on by default).
Limits and IP control
- Traffic / expiry caps disable the client when hit; a Reset period auto-renews the quota.
- Limit IP caps simultaneous source IPs. Enforcement relies on Fail2ban — see Security. You can view a client's recent IPs and clear them from the client's actions.
- Online status and last-online times are tracked per client (and per node in multi-node setups).
Share links and external links
Every client has share links and a QR code for its inbounds, plus a combined
subscription. You can also attach external
links to a client — extra vless://, vmess://, trojan://, ss://,
hysteria2://, or wireguard:// links, or a remote subscription URL — so they
appear alongside the panel-generated ones in the client's subscription.
To inspect exactly what a link contains, paste it into the share-link inspector.
Bulk actions
For managing many clients at once, the panel supports bulk create, enable, disable, delete, attach/detach (to inbounds), reset traffic, and adjust (add days / add bytes / set flow). Maintenance actions also let you delete depleted clients (quota/expiry exhausted) and orphaned clients (not attached to any inbound).
A client's share link contains its credential. Treat links and QR codes like passwords, and rotate the credential if one leaks.