White-label VPN partners often ask how First Run Permissions fits next to a branded Klox client. Short answer: branding, billing, and support are yours; the tunnel is still WireGuard, OpenVPN, OpenConnect, and Shadowsocks on five devices.
First Run Permissions may appear in your stack — website, comments, installers, or admin tools. None of that replaces the VPN protocol or adds a secret "First Run Permissions mode" inside the tunnel.
We keep commercial facts upfront: consumer pricing reference is $2.83/month on the yearly plan with 7-day money-back on your first purchase; partner economics live on /white-label and /reseller.
This page is for founders, agencies, and IT shops packaging Klox under their own name. It is not a consumer setup guide — end users still download your app build and press Connect.
Looking for a reliable VPN?
KloxVPN — from $2.83/month. Apps for every device.
What First Run Permissions is in your stack
Reseller and white-label paths differ; pick one story on your homepage.
Keep marketing, engineering, and support in one thread when `First Run Permissions` changes. Silent renames cause refund spikes.
Store reviewers compare screenshots to real behavior. Mislabelled `First Run Permissions` strings are an easy rejection reason.
Partners grep builds, store listings, and support macros for strings like `First Run Permissions`. That is a packaging question: does the name still ship, should it be renamed, or removed?
It is not a request for a new protocol. Klox white-label ships the same four-protocol core consumers get.
- 1Download the app from klox.app/download — not a random APK site.
- 2Sign in with the account you paid for.
- 3Press WireGuard. Wait for the connected state.
- 4If it fails, try OpenVPN. Still failing: note the network (hotel, campus, home) before you write support.
First successful connect
| Sheet | What it actually is | When to ask | If they deny |
|---|---|---|---|
| iOS Add VPN Configurations | Install a VPN profile / NEVPNManager | On Connect, with one why sentence | Connect cannot work; Settings path |
| Android VpnService consent | OS dialog to start a VPN service | On Connect | Connect cannot work; tap again or Settings |
| Notifications | Banners. Not the VPN glyph | After a session, from a tap | Settings > Notifications; tunnel still works |
| Battery optimization / ignore | Android may freeze background | After they felt a kill in the background | Settings search alias; optional |
| Local network / tracking / Face ID | Often unrelated to a handshake | Only if the client truly needs it | Do not block Connect |
First run is a gauntlet. One reason, one sheet, then Connect. Four sheets is how you train Deny.
— KloxVPN operator notes
Cloudflare Learning: What is a VPN?
Wikipedia: Virtual private network
ExpressVPN: set up the iOS app, VPN configurations sheet (competitor specimen)
Store vs tunnel
App Store screenshots and Play listing text are marketing surfaces. The tunnel handshake is engineering. Keep tickets separated.
Reseller and white-label paths differ; pick one story on your homepage.
When users mention First Run Permissions
If a subscriber cites `First Run Permissions` in a ticket, clarify whether they mean your website, your installer, or a VPN error message.
Your brand promise should match Klox capabilities: WireGuard, OpenVPN, OpenConnect, and Shadowsocks, five devices, honest refund language.
What the tunnel still does
Regardless of brand paint, the client wraps traffic the same way: encrypted tunnel to your chosen server, DNS through the tunnel when configured, kill switch optional per platform.
Keep marketing, engineering, and support in one thread when `First Run Permissions` changes. Silent renames cause refund spikes.
Your brand promise should match Klox capabilities: WireGuard, OpenVPN, OpenConnect, and Shadowsocks, five devices, honest refund language.
Partners win when support scripts are boring and accurate. Excitement in copy usually means someone promised a protocol feature that does not exist.
Do not promise features Klox does not ship — extra protocols, unlimited devices beyond plan limits, or compliance badges you cannot show.
Device cap
five devices per subscription is still enforced. Your pricing page should say so clearly.
Document which version removed or renamed `First Run Permissions` so SEO pages like this one stay truthful.
Protocol choice
WireGuard first, OpenVPN fallback — same as consumer. Document that in partner FAQs.
When unsure, link to /white-label instead of improvising specs in sales email.
Branding checklist around First Run Permissions
Keep marketing, engineering, and support in one thread when `First Run Permissions` changes. Silent renames cause refund spikes.
Store reviewers compare screenshots to real behavior. Mislabelled `First Run Permissions` strings are an easy rejection reason.
If you rebrand, update every surface in one release when possible. Half-old names confuse users and app review.
Keep /download logic in mind: consumer links on your domain should point to your build, not klox.app, unless that is intentional.
Reseller and white-label paths differ; pick one story on your homepage.
Comments and CMS plugins
Some partners embed comment systems or CMS tools named `First Run Permissions`. That is website plumbing, not VPN configuration.
When unsure, link to /white-label instead of improvising specs in sales email.
2FA and admin panels
Protect reseller panels separately. See admin 2FA checklist if you have not locked down logins.
Document which version removed or renamed `First Run Permissions` so SEO pages like this one stay truthful.
Support scripts that work
When unsure, link to /white-label instead of improvising specs in sales email.
Document which version removed or renamed `First Run Permissions` so SEO pages like this one stay truthful.
Ask: OS, app version, protocol, and whether Connect ever worked on another network. Only then dig into build strings like `First Run Permissions`.
Escalate tunnel failures to infrastructure. Escalate storefront or installer naming to your release manager.
Run quarterly content audits on blog posts that mention `First Run Permissions` so partners do not contradict each other.
Refund policy
Mirror 7-day money-back on your first purchase in your terms or explain differences in writing before checkout.
Run quarterly content audits on blog posts that mention `First Run Permissions` so partners do not contradict each other.
Launch week
Use launch checklist so `First Run Permissions` questions do not land on day one.
Keep marketing, engineering, and support in one thread when `First Run Permissions` changes. Silent renames cause refund spikes.
What not to promise
Point enterprise buyers to /trust-center for what Klox publishes today, then add your own policies honestly.
Reseller and white-label paths differ; pick one story on your homepage.
White-label is speed to market with a proven tunnel — not a license to invent physics.
No invented "First Run Permissions encryption." No secret city counts. No SOC 2 badge unless you actually hold one.
Keep marketing, engineering, and support in one thread when `First Run Permissions` changes. Silent renames cause refund spikes.
Competitor comparisons
Compare features you ship. Avoid review-farm copy; it ages badly and triggers store rejection.
Keep marketing, engineering, and support in one thread when `First Run Permissions` changes. Silent renames cause refund spikes.
Next step
Talk to sales via /white-label when you are ready to ship glass with your logo.
Run quarterly content audits on blog posts that mention `First Run Permissions` so partners do not contradict each other.
Release checklist when First Run Permissions appears in builds
Keep marketing, engineering, and support in one thread when `First Run Permissions` changes. Silent renames cause refund spikes.
Confirm billing pages still mention five devices and refund policy accurately.
Reseller and white-label paths differ; pick one story on your homepage.
Search your repo and CI artifacts for `First Run Permissions` before every store submission.
Update release notes if `First Run Permissions` is user-visible.
App review
Apple and Google reject inconsistent VPN claims. Keep copy aligned with actual protocols.
Reseller and white-label paths differ; pick one story on your homepage.
Versioning
Tag builds that change `First Run Permissions` so support can map tickets to releases.
Your brand promise should match Klox capabilities: WireGuard, OpenVPN, OpenConnect, and Shadowsocks, five devices, honest refund language.
Partner FAQ snippets
Q: Does `First Run Permissions` change encryption? A: No. WireGuard, OpenVPN, OpenConnect, and Shadowsocks still powers the tunnel.
Partners win when support scripts are boring and accurate. Excitement in copy usually means someone promised a protocol feature that does not exist.
Q: Refunds? A: Honor 7-day money-back on your first purchase or publish your own policy clearly.
Q: Where is pricing? A: You set retail; reference $2.83/month on the yearly plan only if you mirror consumer tiers.
Q: Do we operate servers? A: You brand and support; infrastructure follows your Klox agreement.
Sales
Point enterprise buyers to /trust-center for published policies.
Document which version removed or renamed `First Run Permissions` so SEO pages like this one stay truthful.
Reseller
Reseller program if you want volume without full white-label.
When unsure, link to /white-label instead of improvising specs in sales email.
Long-term maintenance
When Klox updates core apps, regression-test your branded build before wide release.
Keep marketing, engineering, and support in one thread when `First Run Permissions` changes. Silent renames cause refund spikes.
Train new support staff on tunnel vs branding tickets in the first week.
Store reviewers compare screenshots to real behavior. Mislabelled `First Run Permissions` strings are an easy rejection reason.
Your brand promise should match Klox capabilities: WireGuard, OpenVPN, OpenConnect, and Shadowsocks, five devices, honest refund language.
Branding
When unsure, link to /white-label instead of improvising specs in sales email.
Contact
White-label for partnership questions.
Document which version removed or renamed `First Run Permissions` so SEO pages like this one stay truthful.
Key Takeaways
Document naming decisions, split support tickets, and do not promise features the core app does not have.
Key takeaway: First Run Permissions is part of your brand or stack — not a new tunnel protocol. Klox white-label still ships WireGuard, OpenVPN, OpenConnect, and Shadowsocks on five devices.
Related Resources
Launch your branded VPN
KloxVPN — WireGuard, OpenVPN, OpenConnect, and Shadowsocks, five devices, $2.83/month on the yearly plan. 7-day money-back on your first purchase.
Explore white-labelFrequently Asked Questions
KloxVPN Team
Experts in VPN infrastructure, network security, and online privacy. The KloxVPN team has been building and operating VPN services since 2019, providing consumer and white-label VPN solutions to thousands of users worldwide.