How to Set Up Clash Verge Rev External Controller on Windows

Understand what the external controller does

Clash Verge Rev’s external controller is a local HTTP API exposed by the running Clash-compatible core. It is not the same thing as the HTTP or SOCKS proxy port used by browsers and applications. The proxy port carries traffic; the external controller receives management requests such as reading the current mode, listing active connections, checking proxies, switching policy groups, and loading a web dashboard.

On Windows, a typical setup uses 127.0.0.1:9090 for the controller and a different port such as 7890 for the mixed proxy. The exact numbers are configurable, so do not assume that a connection failure on port 9090 means the core is broken. First confirm which configuration is active and which core Clash Verge Rev has started.

Prepare the Windows configuration safely

Before changing the controller, open Clash Verge Rev and identify the profile that is currently running. A subscription profile may be regenerated during an update, while a local configuration or override file may remain under your control. If you add the controller fields directly to a generated subscription and the provider later replaces the file, your changes may disappear. Prefer the client’s profile override or local configuration mechanism when it is available.

Save a copy of the active YAML before editing. Keep the copy outside the application’s temporary cache directory and remove any public sharing permissions. A configuration can contain subscription URLs, access tokens, node credentials, private keys, and other sensitive values. The secret field is also an authentication credential even though it is only used on the local machine.

The minimal controller-related YAML looks like this:

mixed-port: 7890
allow-lan: false
external-controller: 127.0.0.1:9090
secret: replace-with-a-long-random-token

For a Windows computer used only by one person, 127.0.0.1 is the safer bind address. It accepts requests from the same computer but does not intentionally expose the API to other devices on the LAN. Do not replace it with 0.0.0.0 merely because a dashboard cannot connect. That address listens on all network interfaces and can expose powerful control endpoints to the local network if firewall and authentication rules are incomplete.

Choose and protect the secret token

Use a token that is not the same as your subscription password, Windows password, or a short word such as 123456. A randomly generated value of at least 24 characters is a practical baseline. Avoid spaces, quotation marks, and characters that may be interpreted differently by YAML or a browser URL.

secret: "W7mQ2pL9vR4xN8cK6tY3sH1d"

Quoting the value is optional for many simple tokens, but it makes the intended string clearer when the value contains punctuation. YAML indentation must use spaces rather than tabs. Also make sure there is only one active external-controller and one active secret in the final configuration. Duplicate keys can produce confusing results because different parsers may keep the first or last value.

Start Clash Verge Rev and verify the listener

After saving the configuration, select it in the Profiles or Configurations area of Clash Verge Rev and activate it. Start the core from the main window or tray menu. The exact labels can differ between builds, but the important sequence is the same: activate the intended profile, start the mihomo or compatible core, and inspect the runtime log for configuration or bind errors.

Look for messages indicating that the external controller is listening on the selected address and port. A successful proxy connection does not prove that the controller is available, because the mixed proxy and API listener are separate services. Conversely, the controller may respond while a particular node or rule is unusable.

Windows PowerShell can check whether a process is listening on port 9090:

Get-NetTCPConnection -LocalPort 9090 -State Listen

If the command returns a local address such as 127.0.0.1 and state Listen, something is accepting TCP connections on that port. If it returns nothing, check the active profile, the core startup log, and whether another application is using the port. The following command identifies the process associated with a listening port when Windows provides a matching owning process ID:

$connection = Get-NetTCPConnection -LocalPort 9090 -State Listen
Get-Process -Id $connection.OwningProcess

To check for a port collision before changing anything, use:

Get-NetTCPConnection -LocalPort 9090 -ErrorAction SilentlyContinue

If another application already owns the port, either stop that application or choose a different controller port, such as 9091. Update every dashboard and API client to use the new port. Do not change the mixed proxy port at the same time unless there is a separate reason to do so; changing one variable at a time makes the result easier to diagnose.

Test the API with PowerShell

The controller should be tested before adding a browser dashboard. PowerShell’s Invoke-RestMethod can send a request with the authentication header. The header name used by Clash-compatible external controllers is usually Authorization, with the value prefixed by Bearer.

$token = "replace-with-your-token"
$headers = @{ Authorization = "Bearer $token" }

Invoke-RestMethod `
  -Uri "http://127.0.0.1:9090/version" `
  -Headers $headers

A working request normally returns a JSON object containing the core version. If the response is 401 Unauthorized, the controller is reachable but the token is missing or incorrect. If the request times out or reports that the connection was refused, the listener is unavailable at that address. If the response is 404 Not Found, the port is reachable but the requested endpoint may not be supported by that core or the URL may contain a spelling error.

You can also inspect the running mode and the number of active connections:

Invoke-RestMethod `
  -Uri "http://127.0.0.1:9090/configs" `
  -Headers $headers

Invoke-RestMethod `
  -Uri "http://127.0.0.1:9090/connections" `
  -Headers $headers

Do not paste the full command, token, or response containing private node information into a public support post. Replace the token with a placeholder before sharing diagnostic output.

Connect a browser dashboard

A dashboard is a web interface that calls the external controller API from the browser. It does not replace the core and it does not create a proxy tunnel by itself. The dashboard needs two things: a reachable controller URL and the correct secret token. Some Clash Verge Rev builds provide a dashboard selector or bundled dashboard files; others expect a dashboard directory to be configured separately.

When a dashboard is available locally, open an address similar to:

http://127.0.0.1:9090/ui

The actual path may be /ui, /dashboard, or another path selected by the client. If the browser displays a blank page, a 404 response, or a directory-related error, confirm the dashboard path and the configured external UI directory. A successful API request to /version does not guarantee that static dashboard files exist.

In the dashboard’s connection settings, enter:

• Controller address: 127.0.0.1:9090, or the port configured in the active profile.
• API secret: The exact value from the active secret field.
• Protocol: http for a local controller unless a separately configured HTTPS endpoint is being used.
• Base path: Leave it empty or use the dashboard’s documented API path; do not add /ui to the API base URL unless the dashboard specifically requires it.

A common mistake is entering http://127.0.0.1:9090/ui as the API base URL. The browser page may be served from /ui, but API requests usually go to the controller root, for example http://127.0.0.1:9090/version and http://127.0.0.1:9090/proxies. Follow the dashboard’s own fields rather than combining the page path and API path manually.

Troubleshoot common access and port errors

When Windows reports that the port is already in use, do not repeatedly restart Clash Verge Rev without identifying the owner. Two proxy clients running at the same time can also compete for the mixed port, TUN resources, system proxy state, and controller port. Exit older Clash clients and confirm that only the intended core remains active.

If the API works from PowerShell but the dashboard fails, the problem is usually at the dashboard layer: an incorrect controller URL, an incorrect token, a cached old endpoint, or a missing browser permission. Open the browser’s developer tools and inspect the failed request. A network error means the request did not reach the controller; a 401 response means it reached the controller but failed authentication; a 404 response means the path is wrong or unsupported.

If the dashboard works but traffic does not pass through the proxy, stop changing the external controller settings. Check the separate mixed port, system proxy toggle, active policy group, DNS configuration, and core logs. The controller only manages the core; it does not determine whether Windows applications are configured to use 127.0.0.1:7890.

Complete a clean connection check

After making the setup changes, verify the components in order rather than testing everything at once. First confirm that the intended profile is active. Next confirm that the core is running and that the controller port is listening. Then authenticate against /version. Finally open the dashboard and check status, proxies, and connections.

1. Confirm the active YAML contains one intended external-controller value.
2. Confirm the secret in the dashboard matches the active profile, not an older exported file.
3. Check that the controller address is bound to 127.0.0.1 unless LAN access is deliberately required.
4. Use PowerShell to verify that the chosen port is in the Listen state.
5. Request /version with the Bearer token and confirm a JSON response.
6. Open the configured dashboard path and verify that it uses the controller root correctly.
7. Check a policy group and an active connection from the dashboard.
8. Test an application through the separate mixed proxy port, such as 127.0.0.1:7890.
9. Record the final controller port and proxy port for future troubleshooting.

A reliable Clash Verge Rev Windows setup does not require changing unrelated DNS, rule, subscription, or TUN settings. Keep the controller bound locally, use a private token, verify the API with a direct request, and treat the dashboard and proxy listener as separate components. This approach narrows most failures to one of four areas: the active profile, the listening port, authentication, or the dashboard path.