If your provider gives you a WireGuard config, you can route individual Mac apps through it. Here's the short version for each.
If your provider hands you a WireGuard config, VPNonly can route a single app through it. Most providers now have a dedicated walkthrough:
AirVPN's config generator (sign in first) builds a WireGuard .conf. Its configs include a preshared key, which VPNonly handles without any extra step. Full AirVPN walkthrough →
A VPS with WireGuard costs a few dollars a month and gives you an exit IP nobody else shares. Use the client config you generated when you set the server up.
In VPNonly: open the ⋯ menu, choose Import WireGuard config…, and pick either a single .conf or the zip Mullvad gives you. The zip becomes one entry — pick a country from the menu at the bottom, the same way you would with NordVPN. Then flip the switch next to any app.
The exact privileged engine used by the app is public for inspection. If you live in the terminal, the free command-line version on GitHub is a separate, smaller implementation that works with these providers too: install it with Homebrew and run vpnonly import on the config you downloaded.
Providers hand out wg-quick configs, which include Address, DNS and sometimes MTU lines. Plain wg setconf rejects those, so anything importing them has to strip them out and apply the address separately. If you're scripting this yourself, that's the first thing to get right.
Second: an IPv6-only config won't work with a tool that routes IPv4. Most provider configs include both, so this rarely comes up, but it's worth knowing if a config is refused.
The app’s exact privileged engine source is public and MIT licensed.