You could write a web portal that generate the wireguard configs on the server and offers the user the client config as a download. The portal then can hook up

You could write a web portal that generate the wireguard configs on the server and offers the user the client config as a download. The portal then can hook upto to SAML / OIDC endpoint, use claims / groups / roles to offer specific profile configurations and you treat the keys in the configs as temporary tokens, as you attach an empiry time to the profile such as 8 hours, so your devs need to download a new configuration every day. I have a portal that does this for openvpn: https://github.com/secureweb/openvpn-portal https://github.com/secureweb/openvpn-portal The code quality isn't great as it's my hello world golang project, but I think the idea is fairly sound.