The partner integration without the site-to-site VPN

The partner needs to call one internal service. The traditional answer is a site-to-site VPN: two network teams, an IPsec parameter negotiation, and a go-live measured in months.

On Hoody it is a permission document. A token group holds the bearer token you mint for them; their grant names http on port 8080 and nothing else: the grammar refuses "all ports" outright, so the grant cannot quietly widen. Default deny closes the rest of the container. The proxy validates every request on your own server.

The partner gets a URL and a token. Offboarding is deleting the group. What their traffic can reach fits on one screen, because it was written on one screen.