Putting a site into maintenance mode used to lock out the people deploying it as well, so the usual workaround was an IP allowlist that had to be right.
$ php artisan down --secret="a3f9c11d-4102-4b8e"
# then visit https://shop.example/a3f9c11d-4102-4b8e once.
# a cookie is set, and this browser sees the site normally.
$ php artisan down --render="errors::503" --retry=60
$ php artisan down --redirect=/The secret is a URL rather than a header, which means it works from a phone and from a client’s browser without any tooling — that is the whole point. --render pre-renders a view before the application goes down, which matters because the maintenance page cannot boot the framework. The cookie is signed and expires, so a shared secret does not become a permanent bypass.