Xray. Managing users

This article covers operations on the VPN user list: how the list is laid out, how to grab the connection link, edit a user, temporarily disable or delete them, and purchase slots beyond the free quota. The minimum "install the module and connect the first device" scenario is described in Xray quick start; here we go into more detail.

The user list

The list opens by default on the Xray module page and contains every created user with the current state of each. Above the list, the remaining free licence slots are shown — a hint as to whether there's room for a new user. Users are created with the Create user button; once the limit is reached, the button is disabled and a tooltip explains why. Details on the limit and slots — in the User limit section.

Each user is a separate row that expands on click. Collapsed, the row holds the name, the email address, and the Enabled toggle for temporary deactivation. User actions appear once the row is expanded: click it to expand.

When there are no users yet

Right after install the list is empty: the panel shows an "It's empty here" card with a prompt to create the first user and a Create user button. Once the first user is created, the card disappears and a regular list takes its place.

Expanded user row

The expanded row is where the user gets the configuration for the device and where the actions on them live.

QR code and the connection link

Right under the avatar the row shows a QR code — it contains a link of the form vless://… for an Xray-compatible client. Show this QR code to the user on screen for a camera scan — or save the image file via the QR code button and send it any way you like. The Link button copies the same vless://… string to the clipboard. If you opened the panel from the same device you're going to connect from, copy the link directly: the panel puts it on the clipboard so you can paste it into the client without a camera.

A .conf file isn't used by Xray — clients only accept the link or a QR code with the same link.

Emailing

The Email button sends the connection link to the address from the user's card. Available if SMTP is configured in the panel. If SMTP isn't configured, the expanded row shows a hint "Email sending is not configured on the server." with a To settings link — it leads to the system settings of the panel, where the SMTP relay is enabled. Until the relay is configured, the Email button stays disabled; copying the link and downloading the QR code work independently. For relay setup details, see How to set up an SMTP relay for sending emails.

Editing and deleting

The Edit button opens a dialog with the user's settings (details — in the Editing a user section). The Delete button starts deletion — details in the Deleting a user section.

Email and traffic statistics tiles

Below the buttons — a tile with the user's email address and two tiles with traffic statistics for that user: inbound and outbound. The counters come from Xray statistics, are updated automatically, and show the cumulative volume since the service started. When the Xray service restarts, the counters reset.

Creating a user

The minimum scenario is described in Xray quick start: open the dialog with the Create user button in the list header and fill in the Email and Name fields — both required. Optionally pick the User language for the email with the link; the Enabled toggle in the footer controls the user's state right after creation. The Create button is active while both required fields are filled without validation errors and while the licence has a free slot (see User limit).

At the top of the dialog sits the Mode selector — for a regular user, leave it on Single-hop. The other value, Multi-hop, turns the user into a link in a chain across two servers — covered below, in Mode: single-hop or multi-hop.

⚠️ ISP restrictions

Traffic encryption makes a VPN a reliable way to protect a connection, but in some countries and regions internet providers actively interfere with VPN protocols. Because of this, full availability of the service cannot be guaranteed — regardless of the connection type. If one protocol does not work for you, try another VPN module available in the panel. If none of them work on your network, contact support and we will issue a refund for the license.

Editing a user

In the expanded row click Edit — the Edit user dialog opens.

The dialog lets you change:

• Mode — Single-hop or Multi-hop. The mode can be switched on an existing user without recreating them — more on this in Mode: single-hop or multi-hop.
• Email — the user's identifier in Xray. Editable by the same rules as on creation: the address must be valid and unique among existing users.
• Name — a free-form label for easy navigation in the list.
• User language — the language of the email with the connection link. Default — English.
• Enabled — lets you temporarily disable the account without deleting it.

The Save button is active only when the form has changed compared to the current state.

ℹ️ Changing the email address with active connections

The email address is the user's identifier in Xray, and it's baked into the connection link. If the user has already saved the link in a client app, after the address changes on the server side it will stop matching: for the client to keep connecting, grab the new link from the expanded row and re-import it in the app.

Mode: single-hop or multi-hop

At the very top of the create and edit dialogs sits the Mode selector — the user works either as a standalone proxy or as part of a multi-hop VPN:

• Single-hop — a regular user with a direct connection: the device reaches the internet through your server. This is the default, and it's how every previously created user works.
• Multi-hop — the user becomes a link in a chain across two BeAdmin installs (entry → exit). A fit for when single-hop mode stops working.

When Multi-hop is selected, a Role in the chain selector appears below — the entry hop receives traffic from the client, the exit hop sends it to the internet:

• Entry hop — accepts the client's connections and forwards them to the exit hop. It's this user's vless://… link that the end device receives.
• Exit hop — the final link in the chain: it takes traffic from the entry hop and releases it to the internet. A user in this role has no connection link of its own.

Multi-hop needs a second server with BeAdmin for the exit hop. If you don't have a suitable one yet, our partners offer a VPS with the panel already installed, in a range of locations.

Proven over 15 years in hosting. Your VPS with BeAdmin is ready to go out of the box.

• Germany
• Netherlands
• Sweden
• Switzerland
• Spain
• USA

Select server

European reliability made simple. Launch BeAdmin with your VPS in just one click.

• Germany
• Netherlands
• Sweden
• Estonia
• Romania
• Switzerland
• Spain
• United Kingdom
• USA

Sign up

The mode is switched on an existing user too, without recreation — the identifier (UUID) and connection string are preserved for a single-hop user and for an entry hop. The exception is switching to exit hop: such a user's own connection configuration is turned off, so the panel warns you with the Convert to exit hop dialog: "User … will lose their connection settings after switching to multi-hop exit-hop mode. Any active connection will be dropped."

The full scenario — how to link two servers into a chain, where to get the link and where to paste it, what the multi-hop status means — is covered in a separate article, Xray. Multi-hop mode.

Enabling and disabling a user

The user row has a toggle — a single press enables or disables the account without opening a dialog. A disabled user stays in the list, their traffic statistics are preserved, but their link can't be used to connect. Changes apply immediately, no service restart is needed.

When the user is re-enabled, the link does not change: the same vless://… string already saved in the client app starts working again.

Deleting a user

In the expanded row click Delete. The panel asks for confirmation in the Delete user dialog showing the address of the user being deleted. After confirmation the licence slot is freed — another user can be created in the empty seat.

‼️ Deleting a user is irreversible

After confirmation the account and its identifier are lost forever. The vless://… link that was imported into the client app stops working. The user can't be restored "as they were" — even if you create a new one with the same address, the identifier inside the link will change and the client will have to import a new configuration.

User limit

ℹ️ The free licence allows one user

On the default plan the Xray module lets you create one VPN user — enough for a single device, for example a personal smartphone. For several devices or family members you'll need to purchase additional slots.

What changes at different quota levels:

• Within quota (N < M) — create new users freely.
• Limit reached (N = M) — no more new users can be created. To continue, purchase slots via the Buy more slots link right in the tile, or delete users you don't need.
• Over the limit (N > M, for example after a plan downgrade) — the most recently created users stay in the list but without a working configuration: the link and QR code aren't issued to them, and emailing and editing are unavailable too. To bring them back, purchase slots or delete the surplus users.

The Buy more slots link leads to the Licence section — to purchase a new licence if you don't have one yet, or to change the existing one with the slot count prefilled. The licence sums with the free quota: if the licence specifies, say, 5 slots, you'll have 6 users in total (1 free + 5 from the licence). In the Licence section this capability is shown under the human-readable label Xray VPN.

What's next

• Xray quick start — installing the module and the first connection.
• Xray. Managing the module — managing the service, updating, and uninstalling the module.
• Xray. Multi-hop mode — how to link two servers into an entry → exit chain.
• How to set up an SMTP relay for sending emails — so you can email users the connection link.