Deliver private networking
to every client you manage
Multi-tenant by design. API-first. One control plane, every client isolated. Deploy to client sites without touching their firewalls — NAT traversal is built in. Stop juggling 30 separate vendor accounts.
Built for the shops that run other people's networks
Two-to-five-person IT shops
You look after 5–30 small business clients and the per-customer vendor tax is eating your margin. One unified API instead of 30 dashboards.
Solo IT consultants
A portfolio of long-term clients, each with their own stack. Keep their networks cleanly separated without paying per-seat minimums on half a dozen tools.
MSPs hit by vendor billing pain
Mesh VPN vendors force one account per customer, separate invoices, and no global view. wg0 replaces that with a single control plane and clean tenant isolation.
Internal IT as “internal MSP”
You run networking for multiple business units, subsidiaries, or acquired companies. Treat each as its own isolated tenant without spinning up another platform per BU.
One vendor account per client is a dead-end business model
MSPs who adopt per-device mesh VPN products quickly discover the hidden tax: one vendor account per customer means multiple billing relationships, multiple logins, no unified operational view, and customer credentials tangled together with yours. Every new client adds another browser tab, another invoice to reconcile, another MFA prompt.
wg0's multi-tenant architecture puts every client's networks in their own isolated account. Each client's networks, nodes, tokens, and credentials are isolated at the database level. There is no cross-tenant visibility and no shared namespace. You operate the whole thing via a single REST API and a single operator workflow — without giving up the clean separation your clients expect.
What MSPs can do with wg0 right now
Everything below ships today — production-ready, API-accessible, and battle-tested.
Per-client account isolation
Every customer lives in their own account with zero cross-tenant visibility. Networks, nodes, tokens, and users are fenced at the database layer.
Full REST API, OpenAPI 3.1
Every operation in the product is available over HTTPS with a published OpenAPI 3.1 spec. Automate onboarding end-to-end from your ops tooling.
Personal Access Tokens
Long-lived automation credentials with optional expiry and instant revocation. Keep a dedicated PAT per customer in your secret store.
MCP server for AI automation
Sixteen Model Context Protocol tools. Point Claude Desktop, Claude Code, or Cursor at your managed fleet for conversational operations.
Shared infrastructure
One control plane serves all of your tenants. You pay for the service, not for running the plumbing. Your operating cost does not scale linearly with customer count.
API-first device enrollment
Create networks, mint enrollment tokens, email install scripts — all from a script. A new customer can be fully onboarded before your coffee cools.
What's on the MSP roadmap (enterprise conversations now)
The following MSP-specific features are on the roadmap, shaped by direct input from our first partners:
- Single MSP operator login with in-dashboard client switcher
- Per-customer branded / white-label dashboards
- Per-customer Stripe billing pass-through and invoicing
- Hierarchical account structure (parent MSP → child tenants, sub-accounts, departments)
- Built-in audit log export per client
We're building the MSP-specific UX based on direct feedback from early partners. If these matter to you, contact [email protected] and you'll have a voice in the priority order.
A three-phase path for MSP partners
Every MSP partner we're working with today follows a version of this pattern: get operational on the API today, automate with PATs and MCP, and migrate to the dedicated MSP tier when it lands.
Phase 1 — API-driven onboarding Today
Register each client via the /api/v1/auth/register endpoint from a script. Create their networks programmatically. Mint enrollment tokens. Email them a welcome message with their credentials and dashboard URL. Each client then manages their own devices through the wg0 dashboard while you retain the PAT and operational ownership.
Phase 2 — Automation via PATs and MCP Today
Keep a Personal Access Token per client in your ops tooling. Script continuous monitoring, health reporting, invoice-time customer health summaries, and alerting on offline hosts. Point Claude Code or Claude Desktop at the fleet over MCP for conversational operations — "which of my clients have any node offline more than an hour?" answered in natural language.
Phase 3 — Dedicated MSP tier Roadmap
Single operator login, white-label dashboards, per-client billing routed through wg0, pre-built onboarding flows, and audit log export. Timeline is tied directly to partner feedback — MSPs who engage with sales now get a direct say in which capabilities ship first and how they're scoped.
Questions MSPs ask
Is wg0 a dedicated MSP platform today?
wg0 is a multi-tenant control plane built for API-first operators. You get per-client network isolation, team-scoped access profiles, user management, and a full REST API with an MCP server for AI-assisted operations. A dedicated MSP operator UX — single login with client switcher, branded dashboards, pass-through billing — is on the roadmap. If you want to shape that, talk to us about a design partnership.
Can I support 50 clients today?
Technically, yes. Operationally, you'll write automation around the API to keep it pleasant — PAT management, enrollment scripts, a lightweight internal dashboard for your own operators. If you're comfortable making that tradeoff in exchange for getting in early and influencing the MSP roadmap, contact sales. We'll help you scope it.
Branded / white-label dashboards?
Not yet. All dashboards currently show wg0 branding. Branded and white-label dashboards are on the MSP roadmap and are one of the most-requested items from the partners we're talking to.
Per-customer billing routed through wg0?
Not yet. You bill your clients yourself today — wg0 bills you (the MSP) as the single account owner. Pass-through billing with Stripe is on the MSP roadmap.
Data residency and on-premise?
Enterprise on-premise deployment is available under enterprise agreement — contact [email protected] to discuss residency requirements, deployment architectures, and contract terms. The hosted product today runs out of our managed infrastructure.
What happens if wg0 goes out of business?
Enterprise customers can discuss on-premise deployment rights and escrow terms directly with sales as part of their agreement. Hosted customers can export their configuration and tenant data at any time and migrate to any standard WireGuard-compatible stack — you never lose access to your keys or peer definitions.
Be an early MSP partner
We're building MSP-specific features based on direct feedback from our first partners. Your voice is louder now than it'll be in 12 months.