Last validated: Dec 4, 2025
\nAuth keysare available for all plans.
\nPre-authentication keys (called auth keys) let you register new nodes without needing to sign in using a web browser. This is most useful when spinning up containers, IoT devices, or using infrastructure-as-code systems like Terraform.
\nAn auth key authenticates a device as the user who generated the key. That is, if Alice generates an auth key, and uses it to add a server to her tailnet, then that device is authenticated with Alice's identity. Think of it as logging into a device.
\nHowever, if you use tags with an auth key, after a device logs in as the user who generated the auth key, the device assumes the identity of the auth key's tags.
\nAs an alternative to directly creating auth keys, consider using an OAuth client. You can use an OAuth client and the Tailscale API to programmatically create auth keys.
\nAuth keys can either be:
\nBe very careful with reusable keys! These can be very dangerous if stolen. They're best kept in a key vault product specially designed for the purpose.
\nAn auth key automatically expires after the number of days you specified when you generated the key. You can choose the number of days, between 1 and 90 inclusive, for the key expiry. If you don't specify an expiry time, the auth key will expire after the maximum of 90 days. If you want to continue using an auth key after it expires, you need to generate a new key.
\nYou can enable or disable key expiry on a device by using the Machines page of the admin console and by using the Update device key method in the Tailscale API.
\nIf an auth key expires, any device authorized by it remains authorized until its node key expires. Each device generates a node key when you log in to Tailscale and uses it to identify itself to the tailnet. By default, node keys automatically expire every 180 days. You can change the default node key expiry from the Key Expiry section of the Device management page of the admin console.
\n\nKey expiry for tagged devices is disabled by default. If you change the tags on the device through the admin console, Tailscale CLI, or Tailscale API, the device's key expiry will not change unless you re-authenticate. That is, if it is enabled, it stays enabled; and if it is disabled, it stays disabled. After you re-authenticate, the device's key expiry will be disabled.
\nYou can find recently revoked or expired keys on the Keys page of the admin console.
\nYou must be an Owner, Admin, IT admin, or Network admin of a tailnet to generate a key.
\nTo generate an auth key:
\nOpen the Keys page of the admin console.
\nSelect Generate auth key.
\nFill out the form fields to specify characteristics about the auth key, such as the description, whether its reusable, when it expires, and device settings.
\nThe device settings section lets you set special characteristic for the auth key:
\nWhen you register a node, use the --auth-key option in the tailscale up command to supply the key and bypass interactive login:
sudo tailscale up --auth-key=tskey-abcdef1432341818\nTailscale-generated auth keys are case-sensitive.
\nYou must be an Owner, Admin, IT admin, or Network admin of a tailnet to revoke a key. And you can revoke only your own keys. Tailscale automatically revokes one-off keys after they are used.
\nTo revoke a key:
\nRevoking a key does not deauthorize nodes using the key. To deauthorize a node, delete it from the Machines page.
\nDepending on what devices you're authenticating, consider using an auth key that is:
\ntailscale lock sign CLI command.