You can use Cloudflare access for internal which is tunnel + identity access management for end users.
As someone who travels a lot with machines all over the world, if a node goes offline I can ask someone to reboot a machine .. but there is no way I am giving random people credentials to my machines and network to fix issues.
API keys have 90 day expiry but you can get around that with an oauth app that has credentials that don't expire