wgcf's paid tier needs a brand new account and its dependency graph includes Sentry

Reaching the paid tier means abandoning your existing account

There is a warning in the middle of the license-key section that explains a vendor-side bug. Accounts that have ever connected to the service cannot receive the subscription status even after binding a correct key, and the fix given is to make a new account by running the register command, then to proceed with the key-binding steps immediately without running anything in between. Consequence: the only documented route to the paid tier asks you to throw away an account you have already used. That is a real cost, stated plainly rather than discovered, and it means that for an existing Warp+ user, using a paid key with this tool is effectively a decision to start over, with an issue reference for anyone who wants to check whether it still applies.

Only directly purchased subscriptions are in scope

A caution box sits next to the key instructions and it is short. Only subscriptions purchased directly through the vendor's own application are supported; keys obtained by any other means, including through referrals, will not work and will not be supported. Consequence: those keys are explicitly out of scope, and the project has written the refusal down rather than leaving it to be inferred.

Crash reporting is in the dependency graph

The module manifest's indirect requirements include a commercial error-reporting client at a pinned version. It is marked indirect, so go.mod alone does not show that wgcf sends any diagnostics, and the readme says nothing about it. The direct requirements include github.com/cockroachdb/errors, and the indirect list also carries cockroachdb/logtags and cockroachdb/redact. The trace command is the counterpart here: it prints diagnostic lines about the service's status, so the tool's debugging story and its reporting story sit next to each other in the same binary.

The API client is a placeholder version resolved from a directory

The readme explains the rule for the openapi/ package: the client is generated from a specification file, the code under that package must not be edited by hand, and you regenerate it after changing the specification. Consequence: regeneration depends on openapi-generator, which you install separately from the Go toolchain before running go generate.

A transport-fingerprinting library is a direct dependency

Among the handful of direct requirements is a library whose purpose is to make a Go TLS client look like other specific TLS clients. Consequence: the tool can present a different TLS fingerprint from a stock Go client; the readme does not explain why. The readme closes with a notice that the project is not affiliated with Cloudflare.

Both performance defaults are set for compatibility, not speed

Two settings in the generated profile are deliberately cautious, and both come from the one command that writes the file; only the keepalive has a flag:

wgcf generate --keepalive       # defaults to 25 seconds
wgcf generate --keepalive=60    # uses the specified interval

The keepalive is what keeps a network mapping alive, and it is omitted entirely unless you ask for it, with a default of twenty-five seconds when you do. The maximum transmission unit is fixed at the lowest value the vendor's mobile application uses, with a note that raising it may improve speed. Consequence: the profile you get out of the box is the conservative one, and the MTU in particular trades possible speed for compatibility. That is the right default for something that has to work on arbitrary networks, and the readme documents the reasoning and points at an issue for the detail, which is more than most tools do for the two values that matter most in practice.

The container builds with a newer toolchain than the manifest asks for

The manifest declares a minimum toolchain version and the container definition opens with a builder image from a later release line. Consequence: two compiler generations are in play, the one you are required to have and the one that is actually exercised when the image is built. That is normal drift rather than a defect, and it is the kind of thing that shows up as an unexplained build failure on an older toolchain. The runtime stage is a single static binary on a minimal Linux distribution with the C compiler switched off, which is the part of the definition that actually matters at run time.

The device allowance is shared with the phone app

The license-key section explains that binding an account generated by this tool to a phone's account shares the subscription status, and that there is a limit of five devices linked at a time, removable from the vendor's application on the phone. Consequence: the allowance is a shared resource across the official client and this one, so someone with a phone and a laptop has already spent two of five before touching anything else. Removal also has to happen in the phone application rather than in the tool, which is the sort of asymmetry that leaves people stuck when they unlink the wrong device and wonder why the tool still thinks it is subscribed.

Editorial conclusion

wgcf fits someone who wants a WireGuard configuration file for a consumer VPN service without installing the vendor's own client, particularly on a platform where that client is not offered. It does not fit a paid subscriber who has already used the official client, because the documented route to the subscription tier is to register a brand new account and the vendor bug that forces this is on their side. Anyone who needs a tool that reports nothing to anyone should also note that go.mod lists an error-reporting client as an indirect dependency. Before using it, read the account warning before you register anything, and check how that indirect error-reporting dependency is used.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. README
4. Releases
5. ViRb3/wgcf on GitHub