How to Enable Clash Verge Rev External Controller on Windows

Clash Verge Rev includes a local Web dashboard for monitoring connections, switching proxy groups, viewing rules, and inspecting traffic in real time. On Windows, however, the dashboard cannot communicate with Clash unless the core exposes an external controller API. If the controller is disabled, configured on the wrong port, blocked by Windows Firewall, or protected by an unknown secret, the dashboard may show connection errors even though the proxy itself appears to be working normally.

This guide explains how to enable the Clash Verge Rev external controller on Windows, choose a safe address and port, configure the API secret, connect a Web dashboard, and verify the result from the command line. It also covers common problems such as port conflicts, incorrect YAML indentation, authentication failures, and access attempts from another device on your local network.

What the External Controller Does

The external controller is an HTTP API exposed by the Clash or Mihomo core. It is separate from the local proxy ports used by browsers and applications. A mixed port such as 7890 handles application traffic, while the external controller port, commonly 9090, handles management requests.

A dashboard sends requests to this API to retrieve information or perform actions. For example, it can read the current configuration, list proxy groups, test node delays, change the active node, display active connections, and close an individual connection. The API does not automatically provide a visual interface; it only provides the backend that a dashboard uses.

For a normal single-computer installation, bind the controller to 127.0.0.1. This means that only programs running on the same Windows computer can reach it. It is the safest default because the API can control your proxy configuration and may expose connection information.

Prepare Clash Verge Rev on Windows

Before changing the controller settings, update Clash Verge Rev to a version that includes a functioning Clash-compatible core. Clash Verge Rev can work with different cores, and the exact labels may differ between versions. Mihomo is commonly used because it provides broad compatibility with modern Clash configuration fields. The important point is that the selected core must support external-controller and secret.

First, close unnecessary proxy tools that may already occupy common ports. Another Clash installation, a local development server, Docker service, VPN client, or security application may already be listening on port 9090. You can check the port in Windows Terminal or PowerShell:

Get-NetTCPConnection -LocalPort 9090 -ErrorAction SilentlyContinue

If the command returns no result, port 9090 is probably available. If it returns a listening connection, identify the process with:

netstat -ano | findstr :9090
tasklist /FI "PID eq 1234"

Replace 1234 with the process ID shown by netstat. Do not terminate an unfamiliar process simply to free the port. Instead, either stop the application through its normal interface or select another controller port, such as 9091 or 19090.

It is also useful to locate the active profile before editing anything. Clash Verge Rev may manage several profiles, and editing a downloaded source file may not change the active generated configuration. Use the profile currently selected in the application, and make a backup before making manual changes. If the application regenerates the profile from a subscription, keep your controller settings in the application's override or local configuration area when available.

Enable the External Controller

Open Clash Verge Rev and select the profile that you actually use. Depending on the release, profile editing may be available through a menu such as Edit, Open Folder, YAML, or a profile override page. Add the controller fields at the top level of the YAML file. They must not be nested under proxy-groups, dns, or another section.

# Clash Verge Rev external controller settings
external-controller: 127.0.0.1:9090
secret: replace-this-with-a-long-random-secret

The address contains two parts: the bind address and the TCP port. 127.0.0.1:9090 is appropriate when the dashboard runs on the same Windows computer. A dashboard opened in Chrome, Edge, or Firefox still counts as local access because the browser is running on that computer.

Choose a secret that is difficult to guess. Although the controller is bound to localhost, authentication is still valuable because malicious or unwanted software on the same computer could attempt to call local services. A password manager can generate a random value of at least 24 characters. Avoid spaces, quotation marks, and characters that may be altered when copied into YAML.

external-controller: 127.0.0.1:9090
secret: "Wn7kP2vQ9mL4xR8tC6zA1sF5"

YAML indentation and spelling matter. The field is external-controller, not external_control or externalController. Keep the two settings aligned at the left margin. If you use quotation marks around the secret, use matching ordinary double quotes and make sure the secret entered in the dashboard is exactly the same.

Save the profile and restart the Clash core. In some versions, saving the profile is not enough because the running core loads its configuration only during startup. If Clash Verge Rev provides a reload button, use it first; if the API still does not respond, fully exit and reopen the application. Check that the system tray process has also closed before starting it again.

Connect a Web Dashboard

Once the core has restarted, open a Clash-compatible dashboard. Some Clash Verge Rev releases include a dashboard entry inside the application, while others let you open a built-in page or configure an external dashboard. The dashboard's backend address must match the controller address exactly.

For the recommended local configuration, enter:

• Backend address: http://127.0.0.1:9090
• Secret: the exact value from the secret field
• Protocol: http, unless you explicitly configured an HTTPS reverse proxy

Do not enter the application proxy address such as 127.0.0.1:7890. That port is for forwarding browser or application traffic and does not implement the controller API. Similarly, do not add a trailing path such as /ui unless the dashboard specifically asks for a Web UI URL rather than an API backend URL.

If the dashboard loads but shows empty groups or cannot display connections, first confirm that it supports the core you selected. Some older dashboards understand the original Clash API but not newer Mihomo-specific endpoints. A compatible dashboard should at least be able to retrieve the controller's basic configuration and proxy group list.

For a local dashboard served directly by the Clash core, an optional configuration can specify a UI directory:

external-controller: 127.0.0.1:9090
secret: "replace-this-with-a-long-random-secret"
external-ui: ui

The external-ui value is normally a directory relative to the core's working directory. It does not download a dashboard by itself. The directory must contain the dashboard's built static files, and the selected core must support serving them. If you only use a hosted or separately installed dashboard, you can omit this field.

Verify the Controller From Windows

Testing the API directly helps separate a Clash configuration problem from a dashboard problem. Open PowerShell and request the controller's version endpoint. When a secret is configured, send it as a Bearer token:

$secret = "replace-this-with-a-long-random-secret"
$headers = @{ Authorization = "Bearer $secret" }
Invoke-RestMethod -Uri "http://127.0.0.1:9090/version" -Headers $headers

A working controller normally returns JSON containing version information. You can also query the current configuration:

Invoke-RestMethod -Uri "http://127.0.0.1:9090/configs" -Headers $headers

If you prefer Command Prompt, use curl:

curl.exe -H "Authorization: Bearer replace-this-with-a-long-random-secret" http://127.0.0.1:9090/version

These tests provide useful clues. A connection-refused error usually means that the core is not running, the controller failed to start, or the address and port are wrong. A 401 Unauthorized response means the controller is running but the secret is missing or incorrect. A successful response proves that the API works and directs your attention to the dashboard URL, browser cache, or dashboard compatibility.

Fix Common Windows Problems

Port Conflicts and Address Binding

If Clash Verge Rev reports that it cannot start the external controller, check whether another process owns the port. Choose an unused port and update both the configuration and dashboard backend address. Remember that changing mixed-port does not change the controller port; they are independent settings.

When the configuration uses 127.0.0.1, Windows Firewall usually does not need an inbound rule for access from the same machine. If you bind to a specific LAN address or 0.0.0.0, Windows may display a firewall prompt. Allowing access on a trusted private network is safer than allowing it on public networks.

YAML and Profile Errors

A malformed YAML file may prevent the entire core from loading. Typical mistakes include using tabs instead of spaces, placing the controller fields beneath another key, adding an invisible character when copying text, or editing a profile that is not currently active. Reopen the profile in Clash Verge Rev, validate its syntax if the application offers a checker, and inspect the core log after restarting.

Subscription profiles require extra care. A provider update can overwrite manually added fields. If the controller disappears after every update, use Clash Verge Rev's override feature or a local patch mechanism instead of modifying the remote source directly. Keep the override small so future profile updates remain easy to troubleshoot.

Authentication and Dashboard Cache

When the API works in PowerShell but the dashboard reports an authentication error, remove the saved backend entry and create it again. Check for accidental leading or trailing spaces in the secret. Browser extensions, cached service workers, and an old dashboard version can also preserve an incorrect endpoint. Try a private window or clear the dashboard's stored site data.

Remote LAN Access

To manage Clash Verge Rev from another device on the same private network, you may bind the controller to the Windows computer's LAN address, for example:

external-controller: 192.168.1.25:9090
secret: "use-a-long-random-secret-here"

Replace the address with the Windows computer's current private IPv4 address. You can find it with ipconfig. In the remote dashboard, use http://192.168.1.25:9090 as the backend address. Create a narrowly scoped Windows Firewall inbound rule for TCP port 9090 on the private profile, and restrict the remote address range if possible.

Recommended Final Checklist

After setup, confirm each item before relying on the dashboard:

• The active Clash Verge Rev profile contains external-controller at the top level.
• The controller port is not used by another Windows process.
• The core has been reloaded or restarted after the configuration change.
• The dashboard uses http://127.0.0.1:9090 or the exact LAN address you configured.
• The secret is entered exactly and is sent as a Bearer token.
• The /version endpoint responds successfully from PowerShell or curl.
• Windows Firewall is limited to the private network when LAN access is enabled.
• The secret is stored securely and is not pasted into screenshots, public issue reports, or shared configuration files.

Once these checks pass, the Clash Verge Rev dashboard should be able to display live connections, switch proxy groups, inspect rules, and manage the running core without changing your normal application proxy settings. Keeping the controller on localhost is the best choice for most Windows users; only enable LAN binding when the remote-management benefit justifies the additional security responsibility.