Case 01 · JIT Access

Freelance access that revokes itself.

Hand a contractor a token with a 2-hour TTL. The access vanishes — you cannot forget to close it. No tickets, no shared admins, no cleanup later.

Try Live Demo

How to try:

1. Install the extension for or
2. Enter the demo token: kW9jF
3. Open the demo domain (available from the extension menu) and compare behavior with the extension on and off.

wp.l7.run — With extension: WP admin mockup. Without: 404 error.

See how it works in the video demo above

All scenarios

≤ 20s

From token to first request

Manual revocations to remember

100%

Connections logged & attributable

The problem → L7 Admin Guard way

Status quo

Permanent admins for temporary work.

Every freelancer ends up with a long-lived account, a VPN cert, or — worse — a shared password. After the project ships you're supposed to revoke it. You won't. Two months later the credentials are still live, sitting in someone's password manager.

Long-lived credentials nobody reviews
VPN profiles that outlive the project
Audit-log gaps when accounts are shared

L7 Admin Guard way

Tokens with a self-destruct timer.

Issue a JIT token from the admin panel. Set TTL — from 1 minute to any duration, or make it permanent. Specify the domains you want to grant access to. The contractor pastes it into the extension and works. When the timer hits zero the token is gone. There is nothing to revoke.

TTL: from 1 minute to any duration, or permanent
Access only to allowed domains (each token has its own set of domains)
Individual bandwidth and traffic limits per token
One-click revoke before TTL if you change your mind
Every server connection logged (no TLS termination or MITM)
Tokens can be individual or shared with a team (e.g., limit of 3 active clients)

How it works

Admin Issues token TTL=2h, domain=grafana.acme.io

share via chat →

Contractor Pastes token Extension activates

TLS-SNI →

L7 gateway Routes traffic Until TTL expires, then drops

Step by step

Pick the resources — like in Explorer

In the control panel, multi-select projects and/or domains the same way you'd shift-click files in Finder or Explorer. Right-click → Create token. A small dialog asks for a name, TTL, bandwidth cap. Hit Create — done.

Hand it over

Drop the 5-character token in any chat. The recipient never sees your admin URL. For extra security, you can enable password protection (requiring both token and password) and set a strict limit on the number of activations (e.g., 3 users). Once the limit is reached, nobody else can activate it, even if they know the token.

It expires on its own

As soon as the timer expires, the gateway instantly cuts off access. Any future attempts to open the page will return a 404 error, as if from a stranger. The connection history is preserved. Need to revoke access earlier? One click in the control panel, and the change takes effect on the gateway in a fraction of a second.

Common questions

What stops the contractor from sharing the token?: Device binding. When the extension is installed, each device gets a unique DevID. In the dashboard, you can set the maximum number of allowed clients (e.g., 1 or 3) and change this limit at any time.
Can I extend or modify an active token?: Yes, you can change any setting on the fly: extend, pause, delete, add domains, or increase traffic limits. You can also mass-extend tokens using the context menu (e.g., select multiple tokens and add 1 hour with one click). The extension applies the updates instantly without reconnecting.
Can I grant access to subdomains?: Yes, you can specify either a specific domain or all of its subdomains using a wildcard mask like *.mysite.com, or list them individually.

Ship this in five minutes.

Live demo, no signup. Or grab the trial — every feature, fourteen days, no card.