IVPN on Apple TV — import your WireGuard config into WG Connect

IVPN covers the usual platforms, but there is no IVPN app on the tvOS App Store, which leaves the Apple TV connecting straight out to the internet while everything else in the house is tunnelled. IVPN runs standard WireGuard and generates configuration files for third-party clients. WG Connect is an independent tvOS client that imports one and connects.

Why a third-party client is needed

tvOS requires a dedicated app, and the Apple TV audience is small enough that most VPN providers do not build one. But the protocol is open. IVPN's WireGuard servers are ordinary WireGuard servers, and a .conf file is just a text description of a tunnel — client software is interchangeable.

The practical consequence: you do not need IVPN to ship an Apple TV app. You need a config file and a tvOS WireGuard client.

Getting a WireGuard config from IVPN

IVPN offers WireGuard configuration generation for third-party clients from the account area on their website. Sign in and look for the WireGuard / device configuration section, then follow IVPN's own current instructions — the exact page layout changes from time to time, and some options depend on your plan.

The general shape of it:

1. Sign in to your IVPN account and open the WireGuard configuration section
2. Add a new device key — this is the one the Apple TV will use
3. Choose the location or specific server the configuration should point at
4. Select any server-side options IVPN offers at generation time (DNS / filtering choices, for instance) — they are written into the file
5. Download the .conf to your phone or computer

Always make a dedicated config for the Apple TV. Reusing a laptop's key means two devices competing for the same tunnel, and the connection will bounce between them. A separate key also means you can revoke the TV alone if the device is ever sold or replaced.

Importing it into WG Connect

An Apple TV has no camera, so it cannot scan a QR code a provider shows on screen. WG Connect inverts that: the TV is the one displaying the code. Four ways in, all producing the same profile:

1. Upload from phone (easiest). On the Apple TV: Add Profile → Upload from Phone. The TV shows a QR code, you scan it with the phone holding the .conf, and a small upload page opens. Pick the file and it transfers to the TV over your local Wi-Fi — it never leaves the network.
2. Paste the config text. Open the file in a text editor, copy everything, paste it in.
3. Import from a URL. WG Connect can fetch the config from an address you supply. Only use hosts you control, since the file contains a private key.
4. Manual entry. Enter private key, address, DNS, peer public key, endpoint and allowed IPs by hand. Slow with a remote, but it never fails.

WG Connect detects the protocol from the file itself. An IVPN config is plain WireGuard and will be handled as such — no protocol dropdown to get wrong. The same importer also handles AmneziaWG configs if you have one from another source, and the profile screen shows which protocol was detected.

What to expect once connected

• Connecting takes about a second. If a profile stalls at "connecting", the endpoint or the keys are wrong. Regenerate the config rather than editing it by hand.
• The Apple TV's public IP becomes IVPN's. Anything on the TV that geolocates by IP now sees the server's country.
• Streaming is hit and miss. Netflix, Disney+ and similar services maintain block-lists of commercial VPN address ranges, and IVPN's stated focus is privacy rather than unblocking catalogues. Some apps will work, some will show a proxy error. Keep a second profile or disconnect for those apps.
• Throughput is not usually the limit. WireGuard on an Apple TV 4K will normally be capped by your home connection rather than by the tunnel. Choose a nearby server for latency, a distant one only when you want that country.
• Always-on survives restarts. Enable it in WG Connect's settings and the tunnel comes back after power cuts and tvOS updates without any intervention.
• Idle costs nothing. WireGuard is silent when the network is unused, so there is no reason to disconnect between sessions.

More than one location

A config points at one server. If you want a choice of countries, generate several from your IVPN account and import each as its own profile. WG Connect stores as many profiles as you like and switches between them from the home screen in two clicks.

Frequently asked questions