Proton VPN on Apple TV — import your WireGuard config into WG Connect

Proton VPN covers your phone, laptop and tablet, but there is no Proton app on the tvOS App Store — so the Apple TV stays outside the tunnel. Proton supports plain WireGuard and can generate configuration files for third-party clients. WG Connect is an independent tvOS client that takes that file and connects.

Why a third-party client

tvOS needs a purpose-built app, and few VPN providers ship one. The protocol underneath, though, is not proprietary: Proton VPN runs standard WireGuard, and a WireGuard configuration file is a plain text description of a tunnel. Any conforming client can use it, on any platform.

So rather than waiting for a first-party Apple TV app, you export the config once and hand it to a tvOS client. Same servers, same keys, same encryption — just a different piece of software holding the connection open.

Getting a WireGuard config from Proton VPN

Proton VPN provides a WireGuard configuration generator for use with third-party and platform-native clients. It lives in your Proton account on the web, in the downloads / WireGuard configuration area. Follow Proton's own current instructions there — the exact layout and the options offered have changed over time, and what is available depends on your plan.

In outline, generating a config means:

1. Signing in to your Proton account and opening the WireGuard configuration section
2. Naming the configuration so you can recognise it later — Apple TV is a sensible label
3. Choosing any server-side options Proton offers at generation time (filtering, NAT type, and similar) — these are written into the file and cannot be toggled afterwards from the client
4. Picking the country or specific server the config should point at
5. Downloading the .conf file to your phone or computer

Create a separate configuration for the Apple TV. Two devices sharing one WireGuard key will contend for the same tunnel and the connection will flip back and forth between them. A distinct config per device also means you can revoke the TV's access on its own if you ever need to.

Importing it into WG Connect

The Apple TV has no camera, so it cannot scan a QR code that a provider shows you. WG Connect turns that around — the television is the thing displaying the QR code. Four import paths, all equivalent:

1. Upload from phone (easiest). On the Apple TV: Add Profile → Upload from Phone. The TV shows a QR code; scan it with the phone that has the .conf on it, while both are on the same Wi-Fi. A small upload page opens, you pick the file, and it lands on the TV over the local network.
2. Paste the config text. Open the .conf in a text editor, copy the whole thing, paste it into WG Connect.
3. Import from a URL. WG Connect can fetch the file from an address you give it. Only use hosts you control — the file contains a private key.
4. Manual entry. Type in private key, address, DNS, peer public key, endpoint and allowed IPs by hand. Tedious on a remote, but it is always available as a fallback.

WG Connect parses the file and detects the protocol itself. A Proton config is standard WireGuard, so that is what gets used — there is no protocol setting to choose wrongly. The same importer also recognises AmneziaWG configs if you bring one from elsewhere, and shows the detected protocol on the profile screen.

What to expect once connected

• Connection is near-instant. A WireGuard handshake takes about a second. If a profile hangs at "connecting", something in the endpoint or the keys is off — regenerate the config rather than hand-editing it.
• The TV's public IP is now Proton's. Anything on the Apple TV that looks at your IP sees the server's country instead of your own.
• Streaming services vary. Netflix, Disney+, Prime Video and the rest maintain block-lists of known VPN address ranges. Some Proton servers work with some services at some times; this is a moving target and no client can change it. Keeping a second profile — or simply disconnecting for those apps — is the practical answer.
• Speed is fine. WireGuard is efficient enough that an Apple TV 4K will normally be limited by your home line, not by the tunnel. Nearby servers give lower latency; distant ones are for when you want that country specifically.
• Always-on reconnects by itself. Enable it in WG Connect's settings and the tunnel comes back after reboots and tvOS updates.
• Nothing is sent while idle. WireGuard is silent when you are not using the network, so leaving it connected costs no bandwidth.

Multiple countries

Each config points at one server or country. To have a choice, generate several configs from your Proton account and import each as its own profile. WG Connect keeps as many as you want and switches between them from the home screen in two clicks — no regeneration, no re-import.

Frequently asked questions