{"slug":"device-approval","title":"Device approval","tags":["tailscale","access-control","devices"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Device approval\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nDevice approval is a feature that lets Tailscale network administrators\r\nreview and approve new devices before they can join your Tailscale network (known as a tailnet). Use device approval to ensure only trusted devices, such as workplace-managed laptops and\r\nphones, can access a network.\r\n\r\nDevice approvalis available for [all plans](https://tailscale.com/pricing).\r\n\r\n## [Enable device approval for your network](https://tailscale.com/docs/features/access-control/device-management/device-approval\\#enable-device-approval-for-your-network)\r\n\r\nYou must be an [Owner, Admin, or IT admin](https://tailscale.com/docs/reference/user-roles) of a tailnet to enable device approval.\r\n\r\nEnable device approval from the [Device management](https://login.tailscale.com/admin/settings/device-management) page of the admin console.\r\n\r\n![Enable device approval in the admin console.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fenable-approval.a39f688e.png&w=3840&q=75)\r\n\r\n## [Approve devices from the admin console](https://tailscale.com/docs/features/access-control/device-management/device-approval\\#approve-devices-from-the-admin-console)\r\n\r\nYou must be an [Owner, Admin, or IT admin](https://tailscale.com/docs/reference/user-roles) of a tailnet to approve devices.\r\n\r\nOnce this setting is enabled, a new device that accesses your network displays a\r\nnotification that the device is awaiting approval. A device awaiting approval\r\ncannot send or receive traffic on your Tailscale network until it is approved.\r\n\r\n![A notification informs the user that their device is awaiting approval.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fapprove-device-warning.03add323.png&w=3840&q=75)\r\n\r\nTo approve devices, open the [Machines](https://login.tailscale.com/admin/machines) page of the admin console.\r\nAt the top of the list you will find the device with a **Needs approval**\r\nbadge beneath it.\r\n\r\n![A device needing approval displays the Needs approval badge.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fapprove-device-tag.964c17f8.png&w=1080&q=75)\r\n\r\nYou can review details about the device and user before deciding whether to\r\napprove it. When you're ready to approve the device, select the ![ellipsis icon](https://tailscale.com/files/images/icons/fa-ellipsis-h.svg) menu and\r\nselect **Approve** to allow the device to connect to your network.\r\n\r\n![Approve the device to connect to your network.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fapprove-device.5f06e0fc.png&w=828&q=75)\r\n\r\nAfter approval, the device will immediately be able to connect.\r\nNo restarts or toggling needed.\r\n\r\n## [Pre-approve devices with an auth key](https://tailscale.com/docs/features/access-control/device-management/device-approval\\#pre-approve-devices-with-an-auth-key)\r\n\r\nWhen you generate a new [auth key](https://tailscale.com/docs/features/access-control/auth-keys), you can specify that the key should automatically approve devices for which the auth key is used.\r\n\r\nTo do this, you must:\r\n\r\n1. Generate an auth key which is pre-approved.\r\n2. Then, specify that auth key when authenticating a device. The device is automatically approved.\r\n\r\n### [Generate an auth key which is pre-authorized](https://tailscale.com/docs/features/access-control/device-management/device-approval\\#generate-an-auth-key-which-is-pre-authorized)\r\n\r\nYou must be an [Owner, Admin, IT admin, or Network admin](https://tailscale.com/docs/reference/user-roles) of a tailnet to generate an auth key.\r\n\r\nYou can generate an auth key with a tag by using the admin console or by using the API.\r\n\r\nIn the admin console:\r\n\r\n1. Go to the [Keys](https://login.tailscale.com/admin/settings/keys) page in the admin console.\r\n2. In the **Auth keys** section, select **Generate auth key**.\r\n3. Select **Pre-approved**. This option is only available if device approval is enabled for the tailnet.\r\n4. Select **Generate** to generate the auth key.\r\n\r\n## [Automate device approval](https://tailscale.com/docs/features/access-control/device-management/device-approval\\#automate-device-approval)\r\n\r\nWhen using device approval, you can create a flow to automatically approve a device if it meets specific criteria, such as being on an internal device registry or passing a third-party posture check.\r\n\r\n1. Configure a [webhook](https://tailscale.com/docs/features/webhooks) for [`nodeNeedsApproval`](https://tailscale.com/docs/features/webhooks#events).\r\n2. Upon receiving webhook messages, verify the node against the information that you need.\r\n3. Approve the device by sending a POST request to the [device authorization API](https://tailscale.com/api#tag/devices/POST/device/%7BdeviceId%7D/authorized). For example:\r\n\r\n```shell\r\ncurl \"https://api.tailscale.com/api/v2/device/11055/authorized\" \\\r\n-u \"tskey-api-xxxxx:\" \\\r\n--data-binary '{\"authorized\": true}'\r\n```\r\n\r\nYou can also revoke the authorization for a device by calling the same API with `{\"authorized\": false}` as the payload.\r\n\r\n## [Limitations](https://tailscale.com/docs/features/access-control/device-management/device-approval\\#limitations)\r\n\r\nDevice approval applies to actual devices (like phones, laptops, or virtual machines) rather than tailnet nodes that appear in the admin console. A node is owned by a particular user or a tag, while a device could be shared between multiple users. For a shared device, approval will only be required once, regardless of how many users share it or the number of tailnet nodes created with it. Use [device postures](https://tailscale.com/docs/features/device-posture) for more granular node access management.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Device approval

\n

Last validated: Jan 5, 2026

\n

Device approval is a feature that lets Tailscale network administrators\r\nreview and approve new devices before they can join your Tailscale network (known as a tailnet). Use device approval to ensure only trusted devices, such as workplace-managed laptops and\r\nphones, can access a network.

\n

Device approvalis available for all plans.

\n

Enable device approval for your network

\n

You must be an Owner, Admin, or IT admin of a tailnet to enable device approval.

\n

Enable device approval from the Device management page of the admin console.

\n

\"Enable

\n

Approve devices from the admin console

\n

You must be an Owner, Admin, or IT admin of a tailnet to approve devices.

\n

Once this setting is enabled, a new device that accesses your network displays a\r\nnotification that the device is awaiting approval. A device awaiting approval\r\ncannot send or receive traffic on your Tailscale network until it is approved.

\n

\"A

\n

To approve devices, open the Machines page of the admin console.\r\nAt the top of the list you will find the device with a Needs approval\r\nbadge beneath it.

\n

\"A

\n

You can review details about the device and user before deciding whether to\r\napprove it. When you're ready to approve the device, select the \"ellipsis menu and\r\nselect Approve to allow the device to connect to your network.

\n

\"Approve

\n

After approval, the device will immediately be able to connect.\r\nNo restarts or toggling needed.

\n

Pre-approve devices with an auth key

\n

When you generate a new auth key, you can specify that the key should automatically approve devices for which the auth key is used.

\n

To do this, you must:

\n
    \n
  1. Generate an auth key which is pre-approved.
    2. \n
  2. Then, specify that auth key when authenticating a device. The device is automatically approved.
    3. \n
\n

Generate an auth key which is pre-authorized

\n

You must be an Owner, Admin, IT admin, or Network admin of a tailnet to generate an auth key.

\n

You can generate an auth key with a tag by using the admin console or by using the API.

\n

In the admin console:

\n
    \n
  1. Go to the Keys page in the admin console.
    2. \n
  2. In the Auth keys section, select Generate auth key.
    3. \n
  3. Select Pre-approved. This option is only available if device approval is enabled for the tailnet.
    4. \n
  4. Select Generate to generate the auth key.
    5. \n
\n

Automate device approval

\n

When using device approval, you can create a flow to automatically approve a device if it meets specific criteria, such as being on an internal device registry or passing a third-party posture check.

\n
    \n
  1. Configure a webhook for nodeNeedsApproval.
    2. \n
  2. Upon receiving webhook messages, verify the node against the information that you need.
    3. \n
  3. Approve the device by sending a POST request to the device authorization API. For example:
    4. \n
\n
curl \"https://api.tailscale.com/api/v2/device/11055/authorized\" \\\r\n-u \"tskey-api-xxxxx:\" \\\r\n--data-binary '{\"authorized\": true}'\n
\n

You can also revoke the authorization for a device by calling the same API with {\"authorized\": false} as the payload.

\n

Limitations

\n

Device approval applies to actual devices (like phones, laptops, or virtual machines) rather than tailnet nodes that appear in the admin console. A node is owned by a particular user or a tag, while a device could be shared between multiple users. For a shared device, approval will only be required once, regardless of how many users share it or the number of tailnet nodes created with it. Use device postures for more granular node access management.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}