How To Enable Clash Verge Rev External Controller On Windows

What the External Controller Does

Clash Verge Rev includes an external controller that allows another application, browser dashboard, or automation tool to communicate with the Mihomo core running on your Windows computer. Through this API, you can inspect the current proxy mode, view active connections, switch proxy groups, test latency, and monitor traffic without opening the main desktop window every time.

For beginners, the most important point is that the external controller is not the same thing as the Windows system proxy. The system proxy determines which applications send traffic through Clash. The external controller is a management interface that lets an authorized client control Clash itself. Enabling it does not automatically route more traffic through a proxy, but exposing it incorrectly can allow another device to change your proxy settings.

This guide explains how to enable the controller on Windows, connect a Web dashboard, choose a suitable address and port, create a secret, and verify that the API is working. The examples use 127.0.0.1 and port 9090, which are appropriate when the dashboard runs on the same computer.

1Check the Client, Core, and Active Profile

Before changing any settings, open Clash Verge Rev and confirm that it is actually running a Mihomo-compatible core. The wording and location of options can vary between releases, especially when a profile is imported from a subscription provider. A current Clash Verge Rev build normally includes a Profiles area, a running profile, and a dashboard or settings page related to the external controller.

Next, select the profile that you normally use. The external controller belongs to the core configuration, so editing an unused YAML profile will not change the instance that is currently handling your traffic. If the application shows a profile status such as “Active,” “Running,” or “Current,” use that profile when checking the controller settings.

Understand the Three Main Parameters

The controller configuration usually contains an address, a port, and an optional or required secret. These values work together as the API endpoint:

Do not copy a port number simply because another tutorial uses it. A port can already be occupied by another service, and a clash between applications will prevent the controller from starting. Ports such as 9090, 9097, or 19090 are commonly used, but availability matters more than the exact number.

2Enable the Controller in Clash Verge Rev

Launch Clash Verge Rev with your normal Windows account. In the left navigation, look for a page named Settings, General, Profiles, or Controller. The exact label may differ between versions, but the relevant fields normally include External Controller, Controller Address, API Port, and Secret.

Set the Address, Port, and Secret

1. Enable the external controller switch if the interface provides a separate toggle.
2. Enter 127.0.0.1:9090 as the controller address, or enter the host and port in separate fields.
3. Create a secret with at least 20 characters. Combine upper-case letters, lower-case letters, numbers, and symbols rather than using a familiar password.
4. Save the settings and restart the Clash core if the application asks you to do so.
5. Confirm that the active profile remains selected after the restart.

A typical YAML representation looks like this:

Do not place a space between the address and port, and do not omit the colon. YAML indentation is also significant when you edit a larger configuration file. If the field is managed by Clash Verge Rev, changing it through the graphical interface is safer than manually editing a generated profile, because a subscription update may overwrite manual changes.

Save, Restart, and Watch for Errors

After saving, inspect the application status. A controller that started successfully may show no prominent message, so you should also check whether the core remains running and whether the profile still reports a healthy status. If Clash stops immediately, the most likely causes are an invalid address, a port already in use, malformed YAML, or a secret field that contains unsupported characters.

3Connect a Web Dashboard

Once the controller is enabled, open a compatible Web dashboard. Some Clash Verge Rev versions include a dashboard entry directly in the application. Other versions let you open a locally bundled dashboard or connect to a dashboard hosted elsewhere. The dashboard does not replace the Mihomo core. It sends HTTP requests to the controller endpoint you configured.

When the dashboard asks for an API or controller URL, enter:

When it asks for an authentication token, secret, or API key, enter exactly the secret saved in Clash Verge Rev. Do not add quotation marks unless the dashboard specifically requests them. A URL such as http://127.0.0.1:9090/ is normally equivalent, but entering an extra path such as /ui or /api can cause a connection failure because the dashboard adds its own API paths.

Verify the Dashboard Session

A successful connection normally displays the current mode, active proxy groups, connection count, memory usage, and traffic speed. You may also be able to open a connections page or proxy selection page. Try a harmless read-only action first, such as refreshing the dashboard or viewing the current mode. This confirms that the API is reachable before you attempt to switch a proxy group.

If the dashboard loads but shows no data, check the following details:

• The address is 127.0.0.1, not the router address or the computer’s public IP.
• The port in the dashboard exactly matches the port in Clash Verge Rev.
• The secret has no leading or trailing spaces.
• The Clash core is running the profile where the controller was configured.
• The dashboard is using HTTP for a local endpoint rather than forcing an incorrect HTTPS connection.

4Troubleshoot Common Windows Connection Problems

Most controller failures can be diagnosed without changing proxy nodes or reinstalling Clash Verge Rev. Start by identifying whether the problem is reachability, authentication, or profile state. A browser message such as “connection refused” usually means that no process is listening on the selected port. A “401 Unauthorized” response usually means that the endpoint works but the secret is missing or incorrect.

Check Port Availability

Use PowerShell to test whether Windows can reach the local port:

When the controller is running, the result should show TcpTestSucceeded : True. If it returns false, revisit the address and port, restart the core, and check whether another application has taken the port. You can inspect listening ports with:

If another process owns the port, choose a different unused port in Clash Verge Rev and update the dashboard URL at the same time. Changing only one side creates an avoidable failure.

Resolve Authentication Errors

For an authentication error, copy the secret again from the client rather than typing it manually. Check capitalization, punctuation, and hidden spaces. If you suspect that the secret has been exposed, generate a new one, save it, restart the core, and reconnect every dashboard that should retain access. Treat the secret like an administrative password: anyone who obtains it may be able to change modes, switch nodes, close connections, or inspect proxy activity.

Windows Firewall is usually not involved when both the dashboard and controller use 127.0.0.1, because the traffic stays on the local machine. If you changed the address to a LAN IP, however, firewall rules and network profile settings can affect access. Test locally first before troubleshooting remote access.

5Secure the Controller for Daily Use

The external controller has administrative power, so convenience should not come before access control. For a normal Windows desktop setup, the safest arrangement is a loopback address, a strong secret, and no router port forwarding. This lets a local dashboard work while preventing ordinary devices on the same Wi-Fi network from connecting directly.

Use 0.0.0.0:9090 only when you have a clear reason to manage Clash from another trusted device. Binding to all interfaces may expose the controller to your LAN and, depending on firewall or router rules, to a much larger network. If LAN access is necessary, prefer the computer’s private LAN address, restrict Windows Firewall to the specific private network, and avoid exposing the port to public interfaces.

• Keep the secret private: Do not publish it in configuration screenshots, issue reports, or screen recordings.
• Use a separate dashboard: Avoid unknown Web pages that request your controller secret.
• Review remote access: Remove port forwarding rules that are no longer needed.
• Rotate after sharing: Change the secret immediately if another person has seen it.
• Limit permissions operationally: Use the controller only from trusted devices and close dashboards when finished.

6Final Verification Checklist

Before considering the setup complete, perform a short end-to-end test. First, confirm that Clash Verge Rev is running the intended profile and that Windows applications can still use the proxy normally. Then open the dashboard and verify that it reports the expected mode and proxy groups. Switch only a non-critical proxy group if you need to confirm write access, and immediately check that the change appears in Clash Verge Rev as well.

Finally, close and reopen the dashboard. If it reconnects without changing the Clash configuration, the address, port, and secret are being used consistently. If the connection fails after a computer restart, check whether Clash Verge Rev is configured to start with Windows and whether the core has finished loading before the dashboard tries to connect.

1. Confirm the active Mihomo profile.
2. Confirm the controller address is 127.0.0.1.
3. Confirm the dashboard port matches the configured port.
4. Confirm the secret is present and correctly entered.
5. Test the endpoint with PowerShell if the dashboard cannot connect.
6. Keep the controller local unless LAN management is genuinely required.

With these settings, Clash Verge Rev can provide convenient browser-based management without unnecessarily exposing its control API. The key is to treat the external controller as an administrative service rather than another proxy port: bind it locally, authenticate every request, verify the active profile, and change only one variable at a time when troubleshooting.

Download Clash Free →