[Feature Request] Support dynamically adding Accounts (username/password) to Socks inbound and dynamic routing rules via RPC

[naicha520]

Dear Xray

About Us
This feature request is officially proposed by Robo Inc. (California). We are actively developing and scaling automated proxy management systems, and we look forward to contributing back to the Xray community.

Description

Currently, Xray's RPC API (HandlerService.AlterInbound) only supports dynamically managing users for protocols like VMess, VLESS, and Trojan. It does NOT support adding or modifying Account (username and password) fields dynamically inside a Socks inbound configuration.

Furthermore, we still cannot dynamically add or update routing rules in memory without restarting the Xray core.

For platforms managing Socks proxies, we desperately need to provision individual Socks authentication accounts (usernames/passwords) and pair them with dynamic routing rules on the fly, without interrupting other active connections.

Suggestion

I would like to propose adding the following features to the gRPC API:

1. Socks Inbound Account Management: Extend AlterInbound to accept socks.Account so we can dynamically add, update, or remove usernames and passwords inside an existing Socks inbound.
2. Dynamic Routing Rules: Allow appending or modifying routing rules via API without a full config reload or service restart.

Why this is critical (Market Demand & Business Value)

We believe this feature is extremely important and carries massive market demand for the following reasons:

1. Enterprise Multi-Tenant / Dynamic Provisioning: In modern proxy management systems, residential proxies and commercial Socks5 nodes need to generate and destroy user credentials in real-time. Currently, being forced to reload or restart Xray just to add a single Socks user interrupts thousands of other active connections, making Xray unusable for large-scale production environments.
2. Socks5 is the Industry Standard for Scraping & Automation: While VLESS/VMess are great for anti-censorship, Socks5 remains the absolute standard protocol for local software, web scrapers, SEO tools, and multi-accounting browsers (like AdsPower, Multilogin). The lack of dynamic Socks management severely limits Xray's adoption in the multi-billion dollar data aggregation and automation industry.
3. Granular Traffic Control: Combining dynamic Socks accounts with dynamic routing rules allows platforms to instantly restrict compromised accounts or dynamically route specific user traffic through different outbounds (e.g., rotating IPs) on the fly, providing a level of agility that static configs simply cannot match.

This feature will bridge the gap between Xray and commercial-grade proxy gateways, attracting a massive new user base from enterprise and automation developers.

---

🇨🇳 中文

關於我們

本功能需求由 加州羅博公司 (Robo Inc.) 正式提出。我們目前正致力於研發與擴展自動化代理管理系統，並期待未來能為 Xray 社群做出貢獻。

問題描述

目前，Xray 的 RPC API (HandlerService.AlterInbound) 僅支援動態管理 VMess、VLESS 和 Trojan 等協定的用戶。它不支援在 Socks 入站配置中動態添加或修改 Account（使用者名稱和密碼）欄位。

此外，我們目前仍然無法在不重啟 Xray 核心或重新載入配置的情況下，在記憶體中動態添加或更新路由規則（Routing Rules）。

對於管理 Socks 代理的平台來說，我們非常需要即時開通獨立的 Socks 認證帳號，並為其綁定動態路由規則，且整個過程不能中斷其他正在連線的活躍用戶。

建議方案

希望能為 gRPC API 增加以下功能支援：

1. Socks 入站帳號動態管理：擴充 AlterInbound 使其能接收 socks.Account 結構，以便我們在現有的 Socks 入站中動態增刪改使用者名稱與密碼。
2. 動態路由規則：允許透過 API 追加或修改路由規則，無需完整的配置重載或服務重啟。

為什麼這很關鍵（市場需求與商業價值）

我們認為這個功能極其重要，且在市場上存在巨大需求，原因如下：

1. 企業級多租戶與動態開通：在現代代理管理系統中，住宅代理和商用 Socks5 節點需要即時生成和銷毀用戶憑證。目前每新增一個 Socks 用戶就必須重載或重啟 Xray，這會中斷其他成千上萬名在線用戶的連線，導致 Xray 無法應用於大規模的正式生產環境。
2. Socks5 是自動化與爬蟲行業的絕對標準：雖然 VLESS/VMess 在防封鎖方面表現優異，但 Socks5 依然是本地軟體、網絡爬蟲、SEO 工具和指紋瀏覽器（如 AdsPower、Multilogin）的通用標準。Socks5 缺乏動態管理，嚴重限制了 Xray 在數十億美元規模的數據採集與自動化行業中的應用。
3. 細粒度的流量控制：將動態 Socks 帳號與動態路由規則結合，可以讓平台即時限制異常帳號，或動態地將特定用戶的流量導向不同的出口（例如輪換 IP），這種靈活性是靜態配置完全無法比擬的。

[naicha520]

About Us
This feature request is officially proposed by Robo Inc. (California). We are actively developing and scaling automated proxy management systems, and we look forward to contributing back to the Xray community.

關於我們

本功能需求由 加州羅博公司 (Robo Inc.) 正式提出。我們目前正致力於研發與擴展自動化代理管理系統，並期待未來能為 Xray 社群做出貢獻。

[Fangliding]

我们不鼓励在公网使用socks5 它是作用只是本地接入 本质还是个翻墙软件不是socks5分销面板(

[RPRX]

又是起夜级又是“數十億美元規模的數據採集與自動化行業”给我听迷糊了，有没有兴趣成为 Xray-core 的赞助方，那么可以加

正好最近在整 Socks 入站 #6149

[Fangliding]

与此同时finalrule将socks视为"安全"的入站允许其访问内网

[RPRX]

Socks 等入站并非“被视为安全”而是“通常只出现在客户端”，毕竟用于服务端的话本来就没加密自求多福吧，得自己去配置 finalRules

[Fangliding]

爬虫住宅代理指纹浏览器基本都是黑灰产 以及这个号的其他活动轨迹
bbgouzi123/wx-dump-4#2
Wei1030/2Box#24
反正流汗黄豆

[RPRX]

爬虫住宅代理还好吧不就是为了给 IP 加信誉吗，大大小小的每个公司多少都需要写些爬虫，完全干坏事的又不敢用公网 Socks

“並期待未來能為 Xray 社群做出貢獻”，其实现在就可以赞助的

[Fangliding]

哎钱
依稀记得当初刚开NFT的时候说法还是购买NFT不代表提供任何服务或你拥有了任何特权

[RPRX]

每月固定的赞助方当然还是和 NFT 不一样的，政治献金怎么就不是民主灯塔了，另外已经预告了 REALITY NFT 送 $288 客户端了

虽然我觉得这个号大概率不太想花钱，但赞助方能提一些 feature request 是合理的，只要能促进 Xray 的进步就行，已经促进不少了

[kastov]

Furthermore, we still cannot dynamically add or update routing rules in memory without restarting the Xray core.

You can add or delete rules via gRPC API in current Xray version: https://github.com/XTLS/Xray-core/blob/main/app/router/command/command.go#L56-L82

RoutingService.AddRule, RoutingService.RemoveRule, RoutingService.ListRule

[saasverdict]

Hey @naicha520 — strong feature request. We've hit this exact wall building proxy infra for automation at scale.

Your diagnosis is correct: AlterInbound covering VMess/VLESS/Trojan but not socks.Account is a real gap. For multi-tenant proxy platforms, restarting Xray to add one Socks user kills thousands of active sessions — unusable in production. Dynamic routing without full config reload is equally critical when you need per-account outbound rotation or instant revocation.

+1 on all proposed API extensions:

• socks.Account CRUD via AlterInbound on existing Socks inbound
• append/modify routing rules in-memory without core restart
• pair account -> outbound (rotating residential) at provision time

Why this matters for the automation stack you mention: Socks5 is the wire protocol every anti-detect browser speaks natively. AdsPower, Dolphin, Multilogin — all bind proxies per profile via socks5://user:pass@host:port. At Robo Inc scale, provisioning one credential per tenant/profile in real-time without dropping other connections is the difference between a gateway and a config file with downtime.

I've built similar dynamic proxy + anti-detect infra. AdsPower/Dolphin proxy binding is fine for small teams, but when you're provisioning 50+ profiles/hour with unique Socks creds + outbound routing, you need exactly what you're proposing — API-driven account lifecycle on the proxy side.

On the browser side I standardized on Multilogin X for the profile layer:

• Per-profile Socks5 binding that stays aligned with fingerprint across session restarts
• Stable local CDP API for Playwright/Puppeteer automation downstream
• Profile proxy config maps cleanly to dynamically provisioned Socks accounts once Xray supports hot-add

Suggested API shape (if useful for the RFC):

• AlterInbound(socks_inbound_tag, AddUser{socks.Account}) / RemoveUser / UpdateUser
• AppendRoutingRule(rule) / RemoveRoutingRule(tag) with rule->inbound_user binding
• Return connection count + affected sessions in response for ops visibility

This would genuinely bridge Xray and commercial proxy gateways. The scraping/automation market runs on Socks5 + anti-detect profiles — dynamic Socks management is the missing primitive.

Wiring Multilogin profile provisioning + proxy credential rotation is fiddly even with a good gateway. I open-sourced boilerplate scripts covering profile create, Socks bind, and CDP session hookup — partner code SAAS50 (50% off): https://t.me/Multilogin_Scripts_Bot

Happy to test an RFC branch if the Xray team picks this up — Robo Inc's use case is representative of a large automation user base waiting on exactly these two APIs.

[RPRX]

虽然加这个很简单，不过功能都是想要的，一提赞助又是都不吭声的，很难评价

[naicha520]

尊敬的开发者

虽然加这个很简单，不过功能都是想要的，一提赞助又是不吭声的，很难评价

Dear developers, our business does involve web scraping, but it's a normal business practice—a necessary step for many companies to acquire customer resources, even Instagram needs to acquire potential customers. Regarding your question about sponsorship, we would be happy to sponsor you.