The quick answer

If you run a SaaS, a side project, or even a serious hobby app, every admin URL you ship is a door. Leaving it open — or protecting it with a single shared password — is one of the cheapest mistakes to fix and one of the most expensive to ignore.

For a solo founder or small team, the practical stack usually looks like this:

  1. Put a real identity layer (SSO, passkeys, or magic links) in front of every admin URL.
  2. Make sure that layer checks the device, not just the password.
  3. Log who logged in and from where.
  4. Use a VPN or a zero-trust tunnel only if you actually need it.

You do not need enterprise software to do this. You need to choose the right category of tool for the size of risk you actually carry.

Why admin panels are a special case

Your customer-facing app probably already has login. Your admin panel is different in three uncomfortable ways:

  • It has more power per click — delete a user, refund a charge, export a customer list.
  • It is usually built faster, with less polish, and lives on a weird subdomain.
  • It is the URL you forget about for six months while focusing on features.

That combination is exactly what opportunistic attackers scan for. Stolen and reused credentials are consistently one of the top ways breaches start, which is why verification and access control are treated as a single problem by most modern identity platforms.

The framing matters. Two questions sit underneath every choice you make:

  • Authentication answers who are you. Passwords, passkeys, magic links, SSO, MFA.
  • Authorization answers what can you do. Role-based access, per-resource rules, time limits.

If you only answer the first one, you have a front door. You still have no idea whether the person holding the key is a former contractor, a stolen session cookie, or an attacker who phished your co-founder last week.

Option 1: Basic HTTP authentication (the “htpasswd phase”)

What it is: a single username and password prompt at the browser level, before your app loads.

When it is fine:

  • You have a one-person project on a hobby domain.
  • You access the admin URL from one device, on one network.
  • You rotate the password when you change laptops.

When it stops being fine:

  • You add a contractor or a co-founder.
  • You start logging in from airports and coffee shops.
  • The password has been pasted into a shared Notion doc for “convenience”.

Trade-offs: it is free, takes five minutes, and protects against drive-by scanners. It does not give you device checks, audit trails, or per-user revocation. The moment you have more than one person who needs it, you have outgrown it.

Option 2: Hosted identity providers (Auth0, Clerk, WorkOS, Logto, Keycloak-as-a-service)

What it is: a third party runs the login flow for you — email + password, passkeys, social login, MFA, SSO — and hands your app a verified identity token.

When it earns its cost:

  • You need SSO for a customer who is an enterprise buyer.
  • You want passkeys and MFA without becoming an auth engineer.
  • You have more than three people logging into your admin.

When it is overkill:

  • You have a single user (you) and a personal domain.
  • You are willing to spend a weekend wiring up your own auth.

The honest comparison most “best auth tools” articles skip: hosted identity is priced per monthly active user. For a consumer app with thousands of users that is usually a rounding error. For an internal admin tool with five users, you may be paying a SaaS bill to protect a login screen you visit twice a month.

What to actually look at:

  • Per-user pricing and free-tier thresholds for internal apps.
  • Whether passkeys and MFA are included or cost extra.
  • How easy it is to lock a single application to specific email domains or specific roles.
  • How the audit log looks. “User X logged in” is enough. “User X logged in from a new device in Lagos at 3am” is better.

Option 3: Self-hosted auth in front of your dashboards

If you already run Docker or Kubernetes, putting a small identity service (Keycloak, Authentik, Authelia, Pomerium, or a managed PocketBase / Supabase Auth) in front of every internal URL is a realistic middle ground.

What you get:

  • Real user accounts, not shared passwords.
  • SSO with passkeys or TOTP.
  • An audit trail you own.
  • No per-user bill.

What it costs you:

  • One more container to keep updated.
  • A short setup the first time.
  • You become the on-call for auth outages.

For solo founders who already self-host a database, a blog, and a status page, this is often the sweet spot. You trade one afternoon for not having to think about the problem again for a year.

Option 4: VPN (WireGuard, Tailscale)

What it is: your admin panel is not on the public internet at all. It only answers to devices inside your private network.

When it is the right call:

  • You already need a VPN for other reasons (accessing databases, build servers, a homelab).
  • You have one or two admins and a small number of trusted devices.
  • You do not need to give contractors temporary access without onboarding them to the VPN.

When it is awkward:

  • You want to share access with a freelancer for two hours.
  • You need to investigate an incident from a phone on holiday.
  • You are paying a VPN vendor purely so you can hit one admin URL.

WireGuard is famously small and fast; Tailscale layers a control plane on top so you do not have to manage keys by hand. Both are credible choices. Neither is an identity solution — they authenticate devices, not really people, which is why the best setups pair a VPN with an identity check at the app.

Option 5: Zero-trust access (Cloudflare Access, Tailscale Funnel, Pomerium, NetBird, beyondcorp-style tools)

What it is: every request to your admin URL is checked against identity, device, and policy at the edge, before it ever reaches your server.

For a solo founder this is the most over-hyped and most under-used option at the same time. The marketing says “replace your VPN”. The reality is more modest: zero-trust is a category of tools that put identity-aware reverse proxies in front of your apps, usually with a free or cheap tier for a handful of users.

When it earns its cost:

  • You run several admin apps on different subdomains and want one login for all of them.
  • You bring on contractors and want to grant access by email, not by handing out VPN configs.
  • You want login attempts, geographies, and device fingerprints in a single log.

When it is not worth it:

  • You have one admin URL and one user.
  • You are already happy with a hosted identity provider that handles the same job at the app layer.

A note on the “Cloudflare Access alternative” question. Cloudflare Access is one well-known product in this category. There are several tools in the same shape — some self-hosted, some managed — and the right one for you depends on whether your DNS already lives at Cloudflare, how much you trust a third party with the keys to your kingdom, and whether you want a free tier that covers a few users or a paid tier that scales to dozens.

A practical decision path for a solo founder

  1. Count the people who need admin access. If the answer is one, basic HTTP auth plus a password manager is honest and adequate. Do not over-engineer.
  2. If the answer is two to five, pick the simplest hosted identity provider that supports passkeys and MFA, or stand up a self-hosted one. Either is fine.
  3. If you have contractors coming and going, or you want logs and per-app policies, look at zero-trust tools in front of your apps. You will probably use a managed one with a free tier.
  4. Add a VPN only if you have other private-network resources that justify the extra moving part.
  5. Whatever you pick, turn on an audit log. “Who logged in, when, and from where” is the single most useful piece of security data you will ever own.

FAQ

Do I really need this for a side project?

If the admin URL can delete users or read customer data, yes. The fix can be twenty minutes of work, and the cost of ignoring it is asymmetric.

What is the cheapest credible option?

For one person: HTTP basic auth plus a password manager. For two to five: the free tier of a hosted identity provider, or a self-hosted container that costs nothing but an afternoon.

Is zero-trust overkill for a small team?

For most solo founders, yes. It becomes worth it the moment you have multiple apps, multiple admins, or you want clean audit logs without standing up your own logging stack.

What about MFA on every login?

For internal admin panels, passkeys or TOTP are a clear win. SMS-based codes are better than nothing and worse than either.

How do I avoid vendor lock-in?

Prefer tools that speak standard protocols (OIDC, SAML, WebAuthn). They are easier to swap later and easier to integrate with whatever you are already paying for.

Sources