Home Screen icons are launchers, and everything interesting happens after the tap. The shortcut stores an action graph, the icon opens Shortcuts with that graph, and the Set VPN action asks the system to act on a named configuration. Nothing about the tunnel lives in the icon, which is why the same shortcut can also run from a Focus, an automation or a Back Tap trigger. That indirection explains both the convenience and the failures. Get the target configuration right and the button is dependable; leave it ambiguous and it becomes a switch that sometimes does something.

What the action can see

Set VPN arrived in Shortcuts with iOS 16.4 and operates on the VPN configurations the system exposes to it. The action takes a configuration and an operation, so the two things worth verifying are which entry you selected and what it was asked to do. An entry absent from that list cannot be reached by the action, whatever the client's own settings screen displays.

That list is also where third-party clients diverge. A configuration managed by the system appears as a system configuration, while a client implementing its own tunnel may need to publish its own Shortcuts actions through App Intents before anything is scriptable. If your provider's connection is missing, read the provider's documentation before you rebuild the shortcut, because the missing piece is usually exposure rather than a wrong tap. Guides that install a settings widget are describing a different era, and following one on a current iPhone produces a scavenger hunt rather than a button.

Completion is not connection

The action hands a request to the system and returns. Authentication may still be waiting on a prompt, and the connection may still be negotiating when the shortcut reports success. The only trustworthy confirmation is the resource you actually wanted, opened after the owning client shows the tunnel as connected.

Keep credentials out of the shortcut entirely. A password typed into a text action or pasted into the shortcut's name is stored with the shortcut and synced along with it, which is a worse home for it than the keychain the client already uses.

Policy sits above the button

A disconnect request can be followed immediately by a reconnect when an On Demand rule matches the current network. An Always On configuration on a supervised device does not offer the user a choice at all. The shortcut cannot override either arrangement, and one that appears to fight the policy is simply losing to it quietly.

That is an argument for a narrow, honest intent. Two explicit shortcuts, one named for connecting and one for disconnecting, describe what will happen better than a single toggle whose meaning depends on the state you are in. They are also easier to test: run each from a known state and watch the result.

Build it in five steps

Create the shortcut, add Set VPN, select the configuration, set the operation, and run it once from the editor with the normal authentication. Then open the shortcut's details, choose Add to Home Screen, name the icon after the connection rather than the app, and add it. Apple's Home Screen shortcut guide covers that final step, including the icon choice.

The action's options are worth reading once rather than assuming. A toggle looks friendlier on a Home Screen and behaves worse than a named operation when the tunnel is mid-connection or recovering.

Test again after each major iOS release, because both the action's configuration list and the Settings wording move. A button that worked last year and does nothing this year usually reflects a naming or exposure change rather than a broken tunnel.

What the button is for

Use it as a doorway to a connection you already trust: tap, authenticate, open the private service. It does not install a profile, repair a certificate, or make a client that hides its configuration scriptable.

Write that sentence into the runbook next to the shortcut's name, so nobody spends an afternoon debugging a button that was never going to be able to do the thing.

Makomi ya ndenge moko