Access webform by checking predefined codes
You can create a custom module with a hook_webform_access() callback that looks for authorizations codes.

The below hook grants access to the default Contact form via /form/contact?code=secretcode. Make sure to go to /admin/structure/webform/manage/contact/access and remove 'Create submissions' access to the Contact form.

/**
 * Implements hook_webform_access().
 */
function CUSTOM_MODULE_webform_access(\Drupal\Core\Entity\EntityInterface $entity, $operation, \Drupal\Core\Session\AccountInterface $account) {
  // List of webform ids and authorization codes.
  $webform_authorization_codes = [
    'contact' =&gt; 'secretcode',
  ];

  // Get the current webform.
  /** @var \Drupal\webform\WebformRequestInterface $request_handler */
  $request_handler = \Drupal::service('webform.request');
  $webform = $request_handler-&gt;getCurrentWebform();
  if (!$webform) {
    return \Drupal\Core\Access\AccessResult::neutral();
  }

  // Get the webform id.
  $webform_id = $webform-&gt;id();
  if (!isset($webform_authorization_codes[$webform_id])) {
    return \Drupal\Core\Access\AccessResult::neutral();
  }

  // Get get the code.
  $code = \Drupal::request()-&gt;get('code');
  if (empty($code)) {
    return \Drupal\Core\Access\AccessResult::neutral();
  }

  // If 'submission_page' (aka create) and authorization code is correct,
  // then grant access.
  if ($operation === 'submission_page' &amp;&amp; $code === $webform_authorization_codes[$webform_id]) {
    return \Drupal\Core\Access\AccessResult::allowed();
  }
  else {
    return \Drupal\Core\Access\AccessResult::neutral();
  }
}