Admin Guide

1How it works#

Three things to understand once.

Gateway — the server your team reaches protected sites through. It has a fixed IP that you add to the whitelist on your own server. The gateway gets its settings from the dashboard automatically; you never have to log into it.

Domain — a site you're protecting. You say which gateway it's reachable through and, if needed, which IP and port to send it to.

Token — five characters you hand to a person. They paste them into the browser extension and get access to the domains you allowed, on the terms you set.

About names. The system doesn't care what your domains, tokens and projects are called — the names are for you. But the end user sees the token and domain names in the extension, so write them so a person understands without your commentary: "Client's admin panel", not "wp2".

The flow looks like this:

Browser with extension ──► Gateway ──► Your server
        │
        └── everything else (YouTube, mail) goes directly, bypassing the gateway

What matters from the start:

• Routing is per domain. Only the protected domains listed in the token go through the gateway. The rest of the browser's traffic never touches it.
• The gateway doesn't decrypt traffic. Routing is done by SNI; TLS stays end-to-end between the browser and your server.
• Settings apply on the fly. Change a limit or add a domain and it reaches the gateways within seconds — no restarts, no dropped connections.

2Quick start in five minutes#

The scenario: you have a WordPress site, you want to close /wp-admin off from the entire internet and give two people access.

Step 1. Create a gateway#

Dashboard → Gateways → Create.

Pick a type:

• Shared gateway — available immediately, no extra charge. Fine for most jobs.
• Dedicated gateway — deployed on L7's account, used by you alone. $0.5 per day is charged to your balance: the first charge on activation, then every 24 hours.
• Self-hosted — on your own server. No extra charge from us; you pay your hosting provider, and only for the hours the server exists. Two ways to do it:
  • Auto-deploy: enter a cloud provider API key — Hetzner, Vultr, DigitalOcean, Akamai or UpCloud — pick a location, hit Deploy. A minute later the status turns green. No need to touch the server console.
  • Your own machine: run the install command from the gateway creation dialog. An 8 MB binary with no dependencies and no config files.

You'll need the gateway's IP in the next step — copy it from the gateway card in the dashboard.

Step 2. Lock down the site#

On your server, allow access to the admin panel only from the gateway's IP.

An nginx example:

location /wp-admin {
    allow 203.0.113.10;   # your gateway's IP
    deny all;
    # ... the rest of the configuration
}

Check it: open /wp-admin in a browser without the extension. An outsider must be locked out.

What to serve outsiders: a 403 tells a bot there's something at that address, so a 404 is better. And nginx has a better option still — return 444: the connection closes with no response at all, and the bot gets nothing.

Step 3. Add the domain#

Dashboard → Domains → Add.

Give it a name and the domain. You can leave the gateway alone — the default one will be used (and if you only have one gateway, there's nothing to choose). If the site resolves through ordinary DNS on a standard port, that's all you need.

Step 4. Create a token#

The quick way: right-click the domain → Create token.

The only required field is the name — it's shown in the extension so the person knows what they have access to. Limits are optional: you can set none at all, or cap time, traffic and the number of activations. Your five-character token is ready.

Step 5. Hand out access#

Send the person two things:

1. A link to the extension in the Chrome Web Store or Firefox Add-ons
2. The five characters of the token

They install the extension, paste the token — protected tabs reload automatically and the admin panel opens. No sign-up required.

3Domains#

Basic setup#

The minimum is a name and a domain. The gateway is filled in by default; everything else is there when you need it.

A quicker way to fill the form: copy the page address from your browser and press Paste from clipboard. The name (the domain without its zone), the domain itself and the path are split into their fields automatically.

Overriding IP and port#

You can specify the address the gateway should send requests for this domain to, regardless of what public DNS says. The gateway has its own DNS resolver, so a public record isn't required at all.

That opens up three scenarios:

A service with no DNS record. The domain isn't in public DNS at all — for everyone except your team it doesn't exist. You can even use non-existent zones like grafana.internal or billing.local: public DNS can't resolve those in principle, while the gateway resolves them from your settings.

A non-standard port. An internal service sits on 8443 or 3000 — just specify the port (you don't have to override the address as well). The port isn't open to the outside, and the team uses the ordinary https://tool.company.com.

Another host instead of an IP. Instead of an IP you can point at another host name — the gateway will take its address from DNS. Handy when the backend's address changes but its name doesn't.

A private IP or localhost. If the gateway sits on the same machine or in the same network as the service, you can use a private address or 127.0.0.1. The unencrypted leg then never leaves the machine.

Domain scope#

The switch next to the domain field sets what the rule covers:

Domains go through lazy moderation: an automatic check against greylists. Constructs like *.com are not supported.

Domain privacy settings#

Show in list is worth turning off for technical domains a user never types into the address bar (APIs, CDNs, supporting services) — the list in the extension stays clean and readable. Access keeps working as usual.

Private session only and Protected token only are policies: mark the domain once and every token it ever lands in obeys the requirement automatically. When a token with such a domain is created, the dashboard requires a password (or turns private mode on) — forgetting is not an option.

If the domain is added to an existing token without a password, the dashboard won't let it happen. The easiest route is to duplicate the token: all settings carry over, and you just set a password and add the domain.

If the policy is turned on for a domain that's already in password-less tokens, those tokens don't break — the domain inside them becomes disabled. There's no access to it, but when you edit the token you see it greyed out, and if you try to enable it the dashboard explains that you either create a protected token or change the domain's policy.

Only the workspace owner and an administrator can change domain policies. A manager cannot.

4Projects#

A project is a named list of domains. Instead of adding fifteen domains to every token by hand, you add one project.

The key property: the list is dynamic. Add a new domain to a project and it appears in every token that includes that project. Nothing to reissue, nothing to resend.

Switching individual domains off inside a token#

Inside a token, any domain or an entire project can be switched off without being removed. Switching off applies to that token only and doesn't affect anyone else.

What it's for:

• Gradual onboarding. A newcomer got two projects, but billing, production and the database console are switched off. A week later they're switched on with one click — no hunting for missing domains.
• A temporary pause. A contractor finished a stage — switch the whole project off. They're back — switch it on.

When you add a domain to a project, remember: it becomes available to every active token of that project.

If only one person needs a domain, don't add it to the project. Inside the token itself press Add domain and pick it — it lands in the token as a standalone item, even if that domain also belongs to some project. Other tokens are unaffected.

5Gateways#

Types#

Dedicated gateways and daily billing#

The $0.5 is charged on activation and every 24 hours after that.

Stopping a gateway stops it accepting connections, but not the charges: the VPS and the IP stay reserved for you and billing runs until the gateway is deleted. Stop it when you need to cut access off temporarily, not to save money.

Deleting a gateway stops the charges.

If you only need a gateway occasionally, deleting it after the job and deploying a new one is cheaper — installation takes about a minute. Just keep in mind that deleting it loses the IP, which means the whitelists on your servers need updating.

Self-hosted#

Two ways to install:

Auto-deploy through the provider's API. You enter an API key, pick a location, press Deploy. The server is created and configured automatically, in about a minute. No SSH access needed.

Five providers are supported: Hetzner, Vultr, DigitalOcean, Akamai (Linode) and UpCloud. The dashboard tells you which key exactly is needed and where to get it once you pick a provider.

These five specifically, because their servers are cheap and come with generous traffic allowances. The gateway needs no cores, no disk and no memory: the smallest plan will do, and the included traffic is the only thing worth comparing. AWS and GCP aren't supported: for the same money you'd get noticeably less traffic.

Create a separate key for L7 with minimal rights: it's only used to create and delete a server. Such a key can be revoked without touching the rest of your infrastructure.

Billing is hourly. At all five providers a server is billed by the hour, not by the month. Which means the gateway doesn't have to exist permanently: bring one up for a specific job — an audit, a contractor's work, an incident — and delete it, paying for a few hours. Deployment takes about a minute, so bringing up another one costs you nothing but a click.

Two consequences worth remembering:

• The provider's meter stops when the server is deleted. Make sure the server really is gone from the provider's console, not just the gateway from the L7 dashboard.
• A new server gets a new IP. The whitelists on your servers will need updating — that's the one thing that stops you creating and deleting gateways completely thoughtlessly.

Installing on your own machine. The command comes from the gateway creation dialog. Requirements: Linux and a free port. An 8 MB binary, no dependencies, no configuration files — every setting arrives from the dashboard over a secure channel.

If 443 is taken, specify another port when creating the gateway and the install command will use it.

Autonomy#

Gateways keep their state on disk and keep working when they lose contact with the dashboard. Setting changes arrive incrementally as soon as the connection is back.

Keep this in mind when revoking access: if a gateway is unreachable from the dashboard at that moment, the change applies once the connection is restored. Under normal conditions that's seconds.

6Tokens#

What a token is#

Five characters that stand in for a configuration file. You can read them out over the phone, send them in a message, write them on paper. A token is reusable: one token can serve several people if you allowed several activations.

A token is an invitation, not a password. The identity in this system is the device: on activation the extension registers and receives an identifier and a key of its own. That's why you can revoke one person's access without touching anyone else's.

Limits#

Every token has its own limits, independent of other tokens.

Time. Pick a preset or type a value:

When the clock starts is up to you:

• From creation — the token lives for the set period whether it's used or not.
• From first activation — the timer starts when the person first pastes the token. Created on Friday, activated by the contractor on Monday, and they get their three hours.

You can also set an activation window — a "from" and "to" period during which the token can be activated at all. Miss the window and the token is gone; unused tokens don't pile up.

The activation window and the token's lifetime are independent. If the window is 3 days and the lifetime is a month, someone who activates on the third day gets a full month of access from the moment of activation.

Traffic. A hard limit per token. When it runs out, access stops. Traffic can be topped up at any moment — the increase applies immediately and current connections aren't cut: if the person is downloading a file right then, the download won't break.

The quick way: right-click a token → ready-made values like "+100 MB". It works on several selected tokens at once. Time is added the same way.

Activations. How many devices in total can use the token. One activation — a token for one person. Three — for a group of auditors, say.

Once the limit is used up, a new device can't connect even with the right token. The limit can be changed at any time: raising it immediately allows new devices, lowering it applies only to future connections — it doesn't disconnect people who are already working, even if there are more of them than the new limit.

Password-protecting a token#

You can set a password in the token's settings. Such tokens start with a capital letter — you can see from the spelling that a password will be needed. The configuration can be downloaded with the token, but not decrypted without the password.

Tokens use the base58 alphabet, where case is significant: Ifyu58 and ifyu58 are different tokens. When reading one out, say which letters are capitals.

The person pastes the token and the extension immediately asks for the password. Send the password separately from the token — otherwise the protection is pointless: the token in a messenger, say, and the password by voice or another channel.

Private mode in the extension#

A user can turn on private mode in the extension. Then, when the browser closes, tokens and their configurations are forgotten — nothing is left behind on someone else's machine or a shared one.

On reconnecting, the device keeps its previous identifier, so this doesn't count as a new activation and doesn't use up the token's limit.

Working with lists#

The tables behave like a familiar file manager, not like a web form.

Selection: by rubber-band (lasso), with Ctrl one at a time, with Shift by range.

Right-click opens a context menu for the selection:

• create a token from the selected domains
• change the gateway or project on several objects at once
• extend the deadline, add traffic in ready-made amounts
• switch on or off
• duplicate

Keyboard:

Date format. Right-click a date column header → Absolute / Relative time. Absolute is shown in your time zone, relative shows "how long ago". The switch applies only to the column you called it on.

7Devices#

Every activation of a token creates a device record with an identifier of its own.

What you can do with that:

• See how many devices activated the token, and when
• Revoke a specific device — the others keep working with the same token
• Rename it for convenience ("contractor's laptop", "work machine")

Revocation applies within seconds. A person with a revoked device loses access immediately — restarting the browser isn't required and won't help.

8Team and roles#

You can invite a colleague into the workspace with one of four roles.

Owner — the workspace owner, can do everything including payment and plans. There's one owner; there can be any number of members in the other roles.

Admin — the whole configuration except billing. Sets up domains, gateways and security policies.

Manager — day-to-day work: creates and hands out tokens, manages projects, revokes devices. Domains and gateways are out of reach: configuring them requires matching changes on your servers (whitelisting the gateway's IP), so it stays with the senior roles.

Viewer — read-only. Suits reporting and oversight without the right to change anything.

The split isn't a formality: a manager can handle the daily access routine but cannot move the perimeter — add a domain, change a gateway or weaken a security policy.

Additional members are billed against your balance.

Sign-in methods#

You can attach several sign-in methods to one account and use whichever you like:

• email and password
• email and a one-time link (magic link)
• Google, GitHub, Microsoft
• Telegram — via a link to the L7 AG bot or a QR code from your phone

Attaching several methods protects you from losing access: if one provider is down, you sign in through another.

A new sign-in method can only be attached from inside an already authenticated session, in your profile settings. Signing into someone else's account through a provider with a matching email address is not possible.

The subscription belongs to the workspace, not to a particular user: changing the team's composition doesn't affect it.

9Scenarios#

Contractor access for the length of a job#

Create a token: the domains needed, 1 activation, time 4D counted from first activation, activation window of a week. Hand over the five characters. Four days after the work starts, access disappears on its own. Nothing to delete.

A team of auditors#

A token with 3 activations, time eow, a traffic cap. Three reviewers get access until the end of the week, each from their own device, and each can be revoked separately.

An internal service with no public DNS#

Don't create a DNS record at all — even a name in a non-existent zone will do, grafana.internal for instance. Add the domain, give it an address and a port if needed. As far as the internet is concerned that domain doesn't exist; for the team with the token it opens.

Verifying a site migration#

Put the new server's IP in the domain's settings. The team with the extension sees the new site at the production address, visitors see the old one. Toggling the extension shows one version, then the other — compare as many times as you like. When everything checks out, you change the public DNS.

Gradual onboarding#

Give the newcomer whole projects and switch off what they don't need yet. Switch things back on as they settle in — one click each, no hunting for domains and no new token.

10Troubleshooting#

The site won't open even though the token is in. Check that the domain is in the token and not switched off, that neither the deadline nor the traffic limit has run out, and that the gateway's status is "active". Check that the gateway's IP really is allowed on your server.

An old version of the site opens after a settings change. Settings apply within seconds, but the page may be in the browser cache. Reload bypassing the cache.

The extension shows an activation error. Check the token's activation limit — it may be used up. Check whether the activation window has expired.

An internal service doesn't respond through the gateway. Make sure the gateway can actually reach the service: if the service is on a private IP or localhost, the gateway must be in the same network or on the same machine.

The gateway won't come up through auto-deploy. Check that the provider's API key has the right to create servers and that the provider account has no restrictions in place (a server limit, an unpaid invoice).

11Limitations#

An honest list of what the system doesn't do — so you don't spend time finding out.

• Browser HTTP/HTTPS only. SSH, databases and access from the CLI or scripts are not supported yet. A client for TCP-over-HTTPS is planned.
• The gateway must be reachable from outside. The extension connects to the gateway at its address and port, so a gateway behind NAT without port forwarding won't work.
• One domain, one route at a time. Within a single browser a domain goes either through the gateway or directly. To compare two versions of a site side by side, use two browsers.
• Browsers: Chrome, Firefox and everything based on them — Edge, Brave, Vivaldi, Opera, Arc, Zen and others. Safari is not supported.
• Mobile: standard mobile browsers don't support extensions, so it doesn't work there. It does work in mobile browsers that support them — Firefox for Android and Kiwi, for example.