Secure access
Give contractors the access they need, and no more
Scope a contractor to one resource, set it to expire with the engagement, and forget about it. No VPN account to provision, no reminder to revoke.
Give outsiders access that cleans up after itself
The agency needs the staging app for a week. The auditor needs the finance dashboard for a month. So you cut a VPN account and set a reminder to revoke it — and the reminder gets missed. Months later a forgotten contractor account is an attacker’s way in. Most third-party breaches trace back to exactly this: access that outlived its purpose.
| The usual fix | What to consider |
|---|---|
| VPN account | Provisioned, shared over Slack, rarely revoked on time. Persists long after the work ends. |
| Shared credentials | One team login — no attribution, no audit trail, no automatic expiry. |
| Jump box / bastion | Better isolation, but the bastion is visible and needs its own credential management. |
Access that expires when the work does
Mint a qURL scoped to the one resource, with an expiry that matches the engagement.
POST /v1/resources/{id}/qurls
{
"label": "agency@contractor.io",
"max_sessions": 1,
"expires_in": "8h",
"session_duration": "8h"
}A one-session link to one staging app, for one contractor, redeemable within eight hours.
Scope it
Point a qURL at the exact resource — a staging app, an admin console — and scope it to one session for the contractor.
Set the clock
Four hours for a fix, a week for a sprint, a month for a project. It counts down on its own.
It’s gone
When time’s up the link stops opening. A session already open ends at its own limit, or you revoke the link and end it now. Nothing to deprovision, nothing to remember.
What to install, and how someone gets in
Give access with
One qURL per contractor, expiring with the engagement ↗- 01Run
qurl loginwith a key carryingqurl:agentandqurl:resolve - 02Publish the resource with
qurl publish http://127.0.0.1:3000, or run a connector sidecar beside it - 03Mint one link per contractor with
qurl share <CRID> --ttl 8h - 04Check what is still published with
qurl list --status active - 05Run
qurl delete <CRID>when the engagement ends
Bring in contractors without leaving a door open
Automatic expiration
Links stop opening when the engagement ends, and each session has its own limit. No credentials to revoke, no reminders to set.
One link per contractor
Each contractor gets their own qURL, so one can be revoked without touching the others, and access events are sent to your systems.
No VPN overhead
No VPN accounts to provision, manage, or decommission. Contractors access resources via browser.
Scoped to one resource
Contractors see only the specific resource you shared. No visibility into anything else.
Built for
- Companies working with IT contractors and managed service providers
- Organizations with external auditors requiring periodic system access
- Teams giving design and development agencies access to staging environments
- Healthcare organizations sharing system access with third-party specialists
- Any company tired of managing VPN accounts for external partners
Questions
What happens when the engagement ends?
The link stops opening at the expiry you set. A session that is already open ends when its session length runs out, or revoke the link to end it immediately. There is no VPN account to deprovision and no calendar reminder to miss.
Do contractors need to create accounts or install anything?
No. Contractors open the qURL in a browser — no VPN client, no new credentials to manage. A qURL is a bearer link, so issue it after your own sign-in or approval, keep the opening deadline short, and let the application keep its own login.
Can we see what a contractor accessed?
LayerV sends access, denial, and revocation events as signed webhooks to an endpoint you choose, and lists live sessions with their source address and first and last seen. It is not a retained audit log: keep the events in your own systems.
What can a contractor see beyond the shared resource?
Nothing. Each qURL is scoped to a single resource, so there is no network visibility and no lateral movement — the rest of your infrastructure stays invisible.
Related
Make it invisible.
Put the connector beside the app, and issue access from your code.