動態存取金鑰
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
Outline 提供兩種存取金鑰：靜態金鑰與動態金鑰。靜態金鑰將所有連線資訊編碼在金鑰本身，而動態金鑰則編碼連線資訊的位置，讓您能遠端儲存資訊並視需要修改。這表示您可以輕鬆更新伺服器設定，不需要產生新的金鑰來重新分發給使用者。本文件將說明如何使用動態存取金鑰，更靈活有效率地管理 Outline 伺服器。
您可以用三種格式指定動態存取金鑰所用的存取資訊：
使用 ss:// 連結
Outline 用戶端 1.8.1 以上版本。
您可以直接使用現有的 ss:// 連結。如果您不需要經常變更伺服器、通訊埠或加密方法，但又希望能彈性更新伺服器位址，就適合採用這種方法。
示例：
ss://Y2hhY2hhMjAtaWV0Zi1wb2x5MTMwNTpleGFtcGxl@outline-server.example.com:8388/?outline=1
使用 JSON 物件
Outline 用戶端 1.8.0 以上版本。
採用這種方法，您可以更靈活管理使用者的 Outline 連線設定，例如更新伺服器、通訊埠、密碼及加密方法。
示例：
{
"server": "outline-server.example.com",
"server_port": 8388,
"password": "example",
"method": "chacha20-ietf-poly1305"
}
- server：VPN 伺服器的網域或 IP 位址。
- server_port：VPN 伺服器運作的埠號。
- password：連線至 VPN 所需的密碼。
- method：VPN 使用的加密方法。請參考 Shadowsocks 支援的 AEAD 編碼器。
使用 YAML 物件
Outline 用戶端 1.15.0 以上版本。
這種方法和上述的 JSON 方法類似，但因使用 Outline 的進階設定格式而更具彈性。您可以更新伺服器、通訊埠、密碼、加密方法等設定。
示例：
transport:
$type: tcpudp
tcp:
$type: shadowsocks
endpoint: outline-server.example.com:8388
cipher: chacha20-ietf-poly1305
secret: example
udp:
$type: shadowsocks
endpoint: outline-server.example.com:8388
cipher: chacha20-ietf-poly1305
secret: example
- transport：定義要使用的傳輸通訊協定 (此例中為 TCP 和 UDP)。
- tcp/udp：指定每種通訊協定的設定。
- $type：表示設定類型，此處為 shadowsocks。
- endpoint：VPN 伺服器的網域或 IP 位址和通訊埠。
- secret：連線至 VPN 所需的密碼。
- cipher：VPN 使用的加密方法。請參考 Shadowsocks 支援的 AEAD 編碼器。
關於如何設定 Outline 伺服器存取權，包括傳輸、端點、撥號程式和封包監聽器，詳見「存取金鑰設定」。
如果您已經有靜態存取金鑰，可以擷取其中的資訊來建立 JSON 或 YAML 格式的動態存取金鑰。靜態存取金鑰的形式如下：
SS-URI = "ss://" userinfo "@" hostname ":" port [ "/" ] [ "#" tag ]
userinfo = websafe-base64-encode-utf8(method ":" password)
method ":" password
示例：
ss://Y2hhY2hhMjAtaWV0Zi1wb2x5MTMwNTpleGFtcGxl@outline-server.example.com:8388/?outline=1
瞭解如何建立動態存取金鑰後，選擇合適的託管平台來存放您的存取金鑰設定至關重要。在選擇平台時，請考慮其穩定性、安全性、易用性及抗審查能力，包括：能否穩定提供存取金鑰資訊而不停機？是否有適當的安全措施保護您的設定？管理存取金鑰資訊是否方便？在實施網路審查的地區能否正常存取？
如果存取資訊可能受到限制，建議將資訊託管於能對抗審查的平台，例如 Google 雲端硬碟、pad.riseup.net、Amazon S3 (使用路徑樣式存取格式)、Netlify 或 GitHub 的私密 gist。請根據您的部署需求，選擇符合存取性和安全性要求的平台。
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-03-13 (世界標準時間)。
[null,null,["上次更新時間：2025-03-13 (世界標準時間)。"],[[["\u003cp\u003eThe Outline Client now supports Dynamic Access Keys, allowing for real-time updates to VPN access information without reissuing keys.\u003c/p\u003e\n"],["\u003cp\u003eDynamic Access Keys can host access information as either an \u003ccode\u003ess://\u003c/code\u003e link, simplifying setup for those needing only server switching, or as a JSON object to enable changes to server, port, password, and encryption method.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Sheets, Riseup pad, S3, and Netlify are presented as censorship-resistant options for storing dynamic access information, with clear instructions on how to configure each for use with \u003ccode\u003essconf://\u003c/code\u003e protocol.\u003c/p\u003e\n"],["\u003cp\u003eExisting static access keys can be used to derive the necessary information (server, port, password, method) for creating a JSON-based dynamic key, which is done by decoding the base64 password, then filling in each of the relevant fields.\u003c/p\u003e\n"],["\u003cp\u003eCustom error messages can be sent to users via Dynamic Access Keys by adding an "error" key to the JSON object, allowing for tailored feedback in case of connection failures.\u003c/p\u003e\n"]]],["The Outline Client supports Dynamic Access Keys, allowing VPN information to be hosted remotely and updated dynamically. This enables changing the VPN's location, port, password, and encryption method without re-issuing keys. Access information can be stored as an `ss://` link or a JSON object containing the server, server_port, password, and method. Censorship-resistant options like Google Sheets, pad.riseup.net, S3, and Netlify are suggested for hosting. Dynamic access keys are created by replacing `https://` with `ssconf://` in the access information URL, the user can also include an error message for their end user.\n"],null,["# Dynamic Access Keys\n\nOutline offers two types of access keys: static and dynamic. Static keys encode\nall the connection information within the key itself, while dynamic keys encode\nthe location of the connection information, allowing you to store that\ninformation remotely and change it if needed. This means you can update your\nserver configuration without having to generate and distribute new keys to your\nusers. This document explains how to use dynamic access keys for more flexible\nand efficient management of your Outline server.\n\nThere are three formats to specify the access information that will be used by\nyour dynamic access keys:\n\n### Use an `ss://` Link\n\n*Outline Client v1.8.1+.*\n\nYou can directly use an existing `ss://` link. This method is ideal if you don't\nneed to frequently change the server, port, or encryption method, but still want\nthe flexibility to update the server address.\n\n**Example:** \n\n ss://Y2hhY2hhMjAtaWV0Zi1wb2x5MTMwNTpleGFtcGxl@outline-server.example.com:8388/?outline=1\n\n### Use a JSON object\n\n*Outline Client v1.8.0+.*\n\nThis method offers more flexibility for managing all aspects of your users'\nOutline connection. You can update the server, port, password, and encryption\nmethod this way.\n\n**Example:** \n\n {\n \"server\": \"outline-server.example.com\",\n \"server_port\": 8388,\n \"password\": \"example\",\n \"method\": \"chacha20-ietf-poly1305\"\n }\n\n- **server:** The domain or IP address of your VPN server.\n- **server_port:** The port number your VPN server is running on.\n- **password:** The password required to connect to the VPN.\n- **method:** The encryption method used by the VPN. Refer to the Shadowsocks supported [AEAD ciphers](https://shadowsocks.org/doc/aead.html)\n\n### Use a YAML Object\n\n*Outline Client v1.15.0+.*\n\nThis method is similar to the previous JSON method but adds even more\nflexibility by leveraging Outline's advanced configuration format. You can\nupdate the server, port, password, encryption method, and much more.\n\n**Example:** \n\n transport:\n $type: tcpudp\n tcp:\n $type: shadowsocks\n endpoint: outline-server.example.com:8388\n cipher: chacha20-ietf-poly1305\n secret: example\n udp:\n $type: shadowsocks\n endpoint: outline-server.example.com:8388\n cipher: chacha20-ietf-poly1305\n secret: example\n\n- **transport:** Defines the transport protocols to be used (TCP and UDP in this case).\n- **tcp/udp:** Specifies the configuration for each protocol.\n - **$type:** Indicates the type of configuration, here it's shadowsocks.\n - **endpoint:** The domain or IP address and port of your VPN server.\n - **secret:** The password required to connect to the VPN.\n - **cipher:** The encryption method used by the VPN. Refer to the Shadowsocks supported [AEAD\n ciphers](https://shadowsocks.org/doc/aead.html).\n\nSee [Access Key Configuration](/outline/docs/guides/service-providers/config) for details on all the ways you can\nconfigure access to your Outline server, including transports, endpoints,\ndialers, and packet listeners.\n\nExtract Access Information from a Static Key\n--------------------------------------------\n\nIf you have an existing static access key, you can extract the information to\ncreate a JSON- or YAML-based dynamic access key. Static access keys follow the\nfollowing pattern: \n\n SS-URI = \"ss://\" userinfo \"@\" hostname \":\" port [ \"/\" ] [ \"#\" tag ]\n userinfo = websafe-base64-encode-utf8(method \":\" password)\n method \":\" password\n\nExample: \n\n ss://Y2hhY2hhMjAtaWV0Zi1wb2x5MTMwNTpleGFtcGxl@outline-server.example.com:8388/?outline=1\n\n- **Server:** `outline-server.example.com`\n- **Server Port:** `8388`\n- **User Info:** `Y2hhY2hhMjAtaWV0Zi1wb2x5MTMwNTpleGFtcGxl` Decoded as\n [base64](https://en.wikipedia.org/wiki/Base64) using a tool like the [Google\n Admin Toolbox\n Encode/Decode](https://toolbox.googleapps.com/apps/encode_decode/)\n\n - **Method** : `chacha20-ietf-poly1305`\n - **Password** : `example`\n\nChoose a Hosting Platform\n-------------------------\n\nNow that you understand how to create dynamic access keys, it's important to\nchoose a suitable hosting platform for your access key configuration. When\nmaking this decision, consider factors like the platform's reliability,\nsecurity, ease of use, and censorship resistance. Will the platform consistently\nserve your access key information without downtime? Does it offer appropriate\nsecurity measures to protect your configuration? How easy is it to manage your\naccess key information on the platform? Is the platform accessible in regions\nwith internet censorship?\n\nFor situations where access to information might be restricted, consider hosting\non censorship-resistant platforms like [Google Drive](https://drive.google.com),\n[pad.riseup.net](https://pad.riseup.net/), [Amazon\nS3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-buckets-s3.html)\n(with path-style access),\n[Netlify](https://dev.to/alexmercedcoder/delivering-json-data-with-netlify-1j96),\nor [GitHub secret\ngists](https://docs.github.com/en/get-started/writing-on-github/editing-and-sharing-content-with-gists/creating-gists).\nEvaluate the specific needs of your deployment and choose a platform that aligns\nwith your requirements for accessibility and security."]]
