Clash Verge on macOS: Network Extension and Keychain Permissions

Distinguish startup blocks, service authorization, and Keychain access

After installing Clash Verge on macOS, launching the app, changing system proxy settings, installing a background service, and accessing the Keychain can each trigger a different prompt. These are separate authorization steps—not problems to solve by repeatedly entering your password. Read the app name, requested action, and target in each prompt before deciding what to do next.

Also distinguish the original Clash Verge from the later-maintained Clash Verge Rev. Their interfaces and service implementations vary by branch and version. This guide uses the System Settings paths in macOS 13, 14, and 15. Names such as “Service Mode” and “TUN Mode” vary by client version, so don’t rely on screenshots from another release to find buttons that may not exist in yours.

Step 1: Resolve the “can’t be opened” alert and launch the app

Check the installation location and processor architecture

1. Choose Apple menu in the top-left corner → “About This Mac.” Machines with Apple silicon typically use the arm64 installer; Intel Macs typically use the x64 installer. If a Universal build is available, follow the release notes.
2. Open the downloaded disk image and drag the client to Applications. Wait for the copy to finish, then eject the disk image. Don’t keep running the app from the mounted installer.
3. Open the client from Finder → Applications. If macOS blocks it, note the full alert and check System Settings. Don’t change system-wide security settings as a first step.

If macOS says it “can’t verify the developer” or Apple can’t check the app for malicious software, open System Settings → Privacy & Security on macOS 13, 14, or 15, then scroll to Security. Use “Open Anyway” only after confirming the source and developer details are as expected, then follow the confirmation prompts. This option usually appears only after you’ve tried to open the app.

“App is damaged” and “will damage your computer” are not the same as a standard unidentified-developer alert. If you see either message, don’t launch the app. Download a compatible installer again from the project’s release source and check the release notes. Disabling Gatekeeper or removing quarantine attributes in bulk is not a general installation step; it bypasses security checks that should be reviewed.

Step 2: Verify the system proxy before setting up TUN

For your first setup, enable only the system proxy and leave TUN off. This lets you verify the subscription, proxy groups, and local listener before troubleshooting, and avoids mistaking an unavailable node for an extension authorization issue. The system proxy mainly affects apps that follow macOS proxy settings; it doesn’t guarantee that every app or UDP traffic will be routed through the proxy.

1. Import your configuration from the client’s Subscription or Configuration page and make it the active configuration. Once the node list appears, open Proxy and select an available node or policy group.
2. Set the mode to Rule, then enable System Proxy in the client. If you’ve changed the listening port, first confirm that the core has reloaded.
3. Open System Settings → Network → your current Wi-Fi connection → Details → Proxies. For a wired connection, select the relevant network service and open Details.
4. Check the HTTP, HTTPS, or SOCKS proxy entries. Enabled entries should point to the address and port the client is actually listening on. A common local address is 127.0.0.1; don’t copy a port from another guide.

For example, use the command below to test only if the active configuration or runtime information explicitly shows mixed-port: 7890. Port 7890 is an example, not the default for every Clash Verge branch. mixed-port can accept both HTTP and SOCKS proxy requests.

curl -I --connect-timeout 10 --max-time 20 \
  --proxy http://127.0.0.1:7890 https://example.com

• If you get HTTP response headers from the target site, the explicit proxy request received a response. This doesn’t prove that every app is being routed through the proxy.
• If you see Failed to connect, check the port, whether the core is running, and the listening address first.
• If the connection to the local proxy succeeds but times out afterward, check the node, rules, and DNS. Repeatedly approving system permissions is unlikely to help.

Command-line tools don’t necessarily use the macOS system proxy, so this example explicitly sets --proxy. Don’t treat a single curl command in Terminal as the definitive test of whether the system proxy is working.

Step 3: Authorize a background service or network extension as needed

Admin password prompts for Service Mode

If you need to route traffic from more apps, open Settings in the client and look for Service Mode or TUN settings. Some versions have an Install Service button; others prompt you to install a service when you enable the feature. If macOS asks for administrator approval, confirm that the prompt followed the action you just took and check the app name, then approve it with an administrator account on this Mac.

This usually requires the credentials for an administrator account on this Mac—not your Apple Account password, subscription password, or node password. Installing a background service may require authorization, but launching a correctly installed service shouldn’t require repeated installations. If a prompt appears every time you launch the app, confirm that it’s in Applications and that you aren’t running multiple branches at once, then check the client logs for service connection errors.

Only manage the extension setting if macOS shows an extension prompt

• macOS 13 and 14: If macOS explicitly says system software from a developer was blocked, open System Settings → Privacy & Security → Security and look for the Allow option associated with that installation. If there’s no matching alert, don’t look for a generic Clash extension switch.
• macOS 15: Find network extension settings under System Settings → General → Login Items & Extensions → Network Extensions. Open the relevant details to review them. An entry appears only if the installed client has registered a component.
• Add VPN Configuration: If the client’s implementation triggers this prompt, check the app name before deciding whether to allow it. Authorization granted to another VPN app doesn’t mean this client is already authorized.

After approving, return to the client and enable TUN again. Check that it stays on and look in the logs for permission errors, unavailable services, or routing failures. Restart only if macOS explicitly asks you to. Otherwise, try quitting and reopening the client first rather than restarting without a specific reason.

Step 4: Identify Keychain prompts—they aren’t required for TUN

The Keychain stores credentials and controls access to them. Needing administrator privileges for the system proxy or TUN doesn’t mean the client must access a Keychain item. If you see “wants to use your confidential information stored in the Keychain,” check two names: which process is making the request, and which item it wants to access.

1. First check whether you just took an action that involves saved credentials, such as saving a password or connecting to a proxy that requires authentication. If the prompt doesn’t match what you’re doing, choose Deny, note the names, and investigate before proceeding.
2. Once you’ve confirmed that the expected app is requesting access to the expected item, you can choose Allow for this session. Consider Always Allow only if you understand why ongoing access is needed and trust the app.
3. To inspect an item, open Keychain Access in Applications → Utilities on macOS 13 or 14. On macOS 15, you can also find it with Spotlight. Don’t confuse Keychain Access with the Passwords app.
4. Select the login keychain and search for the item named in the prompt. Open the matching item and review its details and Access Control. Don’t delete certificates, keys, or an entire keychain if you’re unsure what they’re for.

The Keychain password is usually the same as your Mac login password. If an administrator reset the account password while the old keychain still uses the previous password, they may differ. Repeatedly entering your current login password won’t unlock the old keychain. Follow the system’s Keychain recovery process instead. Resetting the default keychain can make saved credentials unavailable, so it shouldn’t be your first troubleshooting step.

Repeated prompts after updating or replacing the client may mean its signing identity or the item’s access controls have changed, or that a different process is making the request. Check the requester again rather than granting every app access to the item.

Step 5: Verify TUN and rule out conflicts with other network tools

After authorization, keep the same configuration and node, and change only the TUN setting. First confirm that the system proxy works. Then, if needed, turn off the system proxy, leave TUN on, and test the target app. Running multiple VPNs, transparent proxies, or filtering tools at the same time can cause routing and DNS settings to be changed in turn, making the results hard to interpret.

• Browser works, but one app doesn’t: Check whether the app uses its own proxy, DNS, or direct-connection policy. In the client’s Connections page, look for the relevant request and the rule it matched.
• Network drops as soon as TUN is enabled: Turn off TUN first and confirm that regular network access returns. Then check the core logs for routing, DNS, and service errors. Don’t change DNS and switch nodes at the same time.
• macOS shows an existing VPN: Open System Settings → VPN and check the current connection. Temporarily disconnect other VPNs and test again. On a managed work device, follow your organization’s network policies first.
• You can’t authorize the client on a work Mac: If extension settings are managed or you don’t have administrator credentials, contact your device administrator. Reinstalling the client won’t remove device management policies.

You can run ifconfig in Terminal to check for utun interfaces, but seeing utun0 or utun1 alone doesn’t prove that Clash is routing traffic. macOS and other apps can create these interfaces too. Better indicators are a healthy TUN status in the client, no related errors in the logs, the target request appearing in the connections list, and a successful connection.

Restore network access after quitting, and resolve repeated authorization prompts

If you can’t get online after quitting the client, restore your network settings first. Don’t immediately delete your configuration or Keychain items. A leftover local proxy can make your browser keep connecting to a port that’s no longer listening, which can look like the entire Mac is offline.

1. If the client is still open, turn off System Proxy and TUN before quitting normally.
2. Open System Settings → Network → your current network → Details → Proxies, then turn off the proxy entries set by this client. Note any proxies configured for your workplace before changing anything; don’t clear them along with the client’s settings.
3. Open System Settings → VPN and confirm there’s no connection left over from your test. Then reconnect to Wi-Fi or Ethernet and test a regular website.
4. Reopen the client and test once with only System Proxy enabled. Then check Service Mode and TUN separately, noting which step brings the problem back.

If you need to reinstall the service, use the client’s own uninstall and install options where available. Don’t delete system background service files blindly. When asking for help, include your macOS version, chip type, the client’s full name and version, the action that triggered the prompt, and logs with sensitive details removed. Don’t share subscription links, access tokens, or node passwords.