Each side of the tunnel has own generated key and derived public key (defined as "peer" on other side of connection). To act as you are writing you would share the private key between the "clients" which is the worst case you can do (technically you can but I hope nobody would even think about that).
Let think about "client vs. server" roles.
server
- own secret key
- list of all possible peers / users
- each client is represented by own peer definition on server side with relevant public key of the client
client
- own secret key
- one peer definition with the public key of the server
We can say that client is authenticated using one factor authentication and the authentication is realized using public key of the client.
- Granting access to new client mean to add peer definition to server side (can be realize without restarting VPN / without breaking all current vpn sessions).
- Revoking access for the current client mean removing peer definition on server side (again it can be done also without restarting VPN - closing all current sessions).
If I correctly understood your question this "feature" is present in wireguard out of the box without any needs of extensions.