Mullvad on Apple TV — import your WireGuard config into WG Connect

You already pay for Mullvad. There is no Mullvad app on the tvOS App Store, so the Apple TV is the one screen in the house left outside the tunnel. Mullvad speaks standard WireGuard and hands you a configuration file, which is all any WireGuard client needs. WG Connect is an independent tvOS client that imports that file and connects.

Why you need a separate client at all

tvOS is a restricted platform. A VPN provider has to build and maintain a dedicated Apple TV app, and most do not — the audience is small compared to iOS. What providers do almost universally offer is the underlying protocol. Mullvad runs WireGuard and exposes plain WireGuard configuration files, so nothing proprietary is required to connect.

That is the whole trick: instead of waiting for a first-party Apple TV app, you take the same .conf file you would feed to the official WireGuard client on a laptop and give it to a tvOS client instead. The tunnel is identical — same keys, same servers, same encryption.

Getting a WireGuard config from Mullvad

Mullvad publishes a WireGuard configuration generator for exactly this purpose — it is intended for third-party and platform-native WireGuard clients. You will find it in the WireGuard configuration area of your Mullvad account on their website; sign in with your account number and follow their current instructions, since the layout of that page changes from time to time.

Broadly, generating a config involves:

1. Signing in to your Mullvad account and opening the WireGuard configuration section
2. Registering a key for the new device — this is what the Apple TV will use
3. Choosing which country, city or specific server the config should point at
4. Downloading the resulting .conf file to your phone or computer

Generate a dedicated config for the Apple TV. Do not reuse the one your laptop is already using — two devices sharing one WireGuard key will fight over the same tunnel, and you will see the connection flap between them. Mullvad caps how many device keys an account can hold at once, so prune keys you no longer need while you are there.

Importing it into WG Connect

An Apple TV has no camera, so it cannot scan the QR codes some VPN providers show you. WG Connect inverts the flow — the TV shows the QR code and your phone does the scanning. There are four ways in, and any of them produce the same result:

1. Upload from phone (easiest). On the Apple TV choose Add Profile → Upload from Phone. The TV displays a QR code. Scan it with your iPhone or Android phone on the same Wi-Fi network, and a small upload page opens where you pick the .conf file. It transfers straight to the TV over the local network — nothing leaves your house.
2. Paste the config text. Open the .conf in any text editor, copy it, and paste the whole thing into WG Connect. Handy if you have the file on a computer and the Apple TV keyboard paired with your phone.
3. Import from a URL. If the file is reachable at an address you control, WG Connect can fetch it directly. Use this only for hosts you trust — a WireGuard config contains a private key.
4. Manual entry. Type the fields in yourself: private key, address, DNS, peer public key, endpoint and allowed IPs. Slow, but it always works.

WG Connect reads the file and detects the protocol automatically. A Mullvad config is plain WireGuard, so that is what it will use — there is no protocol dropdown to get wrong. If you later import an AmneziaWG config from somewhere else, the same importer handles it and shows the detected protocol on the profile screen.

What to expect once connected

• The handshake is quick. WireGuard connects in about a second. If the profile sits at "connecting", the endpoint or the key is wrong — regenerate the config rather than editing it by hand.
• Your Apple TV's public IP becomes Mullvad's. Anything geo-aware on the TV — the App Store storefront aside — now sees the server's country. Apps that were already signed in do not always re-check immediately.
• Streaming services may object. Netflix, Disney+, BBC iPlayer and friends maintain block-lists of commercial VPN address ranges, and Mullvad's stated priority is privacy rather than unblocking catalogues. Expect some services to work and others to show a proxy error. Keep a second profile, or just disconnect for those apps.
• Speed is rarely the bottleneck. WireGuard on an Apple TV 4K comfortably saturates a normal home line. Pick a nearby Mullvad server if latency matters; pick a distant one only when you specifically want that country.
• Always-on survives reboots. Turn it on in WG Connect's settings and the tunnel re-establishes itself after a power cut or a tvOS update, without you digging out the remote.
• Idle tunnels cost nothing. WireGuard sends no traffic when you are not using the network, so leaving the profile connected all day is free.

Switching servers or countries

A WireGuard config points at one server. To move country you generate a second config from Mullvad's account page and import it as a second profile. WG Connect holds as many profiles as you like and switches between them from the home screen in two clicks, so a small set — one nearby server for everyday use, one abroad — covers most needs without regenerating anything.

Frequently asked questions