macOS setup

Install WireGuard from the Mac App Store.
On your account page, choose Add device. Your WireGuard key pair is made on your side, never by us; there are two ways to do it, described below.
In WireGuard choose Import tunnel(s) from file and pick one or more .conf files.
Allow the VPN configuration when macOS asks, then click Activate.

Alternatively, with Homebrew: brew install wireguard-tools, copy a .conf to /usr/local/etc/wireguard/ (or /opt/homebrew/etc/wireguard/) and run sudo wg-quick up ik-<server>.

Two ways to add a device

In the browser (JavaScript on). The account page generates the key pair inside your browser, sends us only the public key, and shows one .conf download per server with the private key already filled in. Import those directly. The private key exists only on that page: download everything you want before leaving it.

With the WireGuard app (JavaScript off, or if you prefer). In WireGuard choose Add Empty Tunnel; it shows a freshly generated key pair. Copy the public key into the account page, download the ZIP, and paste the Interface and Peer values from a .conf into the empty tunnel, keeping the app's own PrivateKey line (the file says PRIVATE_KEY_HERE there). With wireguard-tools: wg genkey | tee private.key | wg pubkey, then replace PRIVATE_KEY_HERE in the .conf with the contents of private.key.

Checks

With the tunnel on, open our leak check. Each address it shows should be an ironkeel server's; "No answer" means that family was not checked. It can't see DNS or WebRTC: ipleak.net, a leak-check site we do not run, tests your browser for both, and no DNS server or address it lists should be your internet provider's.
The WireGuard window should show a recent Latest handshake.

Limits

macOS has no full kill switch. The WireGuard app can activate a tunnel automatically (On-Demand in the tunnel's settings), but that is not a kill switch: nothing is blocked while the tunnel is down, and Apple services may bypass the tunnel.

If the tunnel stops

If pages stop loading, check your paid-until date first: switch the tunnel off, or use another device. When paid time runs out, the tunnel stops without a message: it stays on, but nothing gets through, and Latest handshake grows more than a few minutes old. To add time, redeem a voucher on the account page, then switch the tunnel back on.