{"slug":"ephemeral-nodes","title":"Ephemeral nodes","tags":["tailscale"],"agent_summary":"Last validated: Dec 4, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Ephemeral nodes\r\n\r\nLast validated: Dec 4, 2025\r\n\r\nEphemeral node usage is included at no cost up to a monthly limit (measured in minutes), which varies by [pricing plan](https://tailscale.com/pricing).\r\n\r\nIf an ephemeral node is present in the tailnet for four or more hours, it will not count against your balance of ephemeral minutes, and will count as a standard [tagged device](https://tailscale.com/docs/reference/syntax/policy-file#tags) instead.\r\n\r\nEphemeral nodes make it easier to connect and then clean up short-lived devices such as containers, cloud functions, or CI/CD systems that spin up and spin down on a regular basis.\r\n\r\nBy default, when you add a new device to your Tailscale network, it appears in the [Machines](https://login.tailscale.com/admin/machines) page of the admin console and in Tailscale client apps. However, short-lived devices can make your network difficult to check, as devices remain in the admin console until removed.\r\n\r\nEphemeral nodes differ from regular nodes in a few ways:\r\n\r\n- They are auto-removed from your network after a short period of inactivity. The next time an ephemeral node is created, it will have a new IP address.\r\n- They are immediately removed from your network if you run [`tailscale logout`](https://tailscale.com/docs/reference/tailscale-cli#logout).\r\n- They can only be created using [ephemeral auth keys](https://tailscale.com/docs/features/access-control/auth-keys) (not through the regular authentication flow) or by running the `tailscaled` daemon with the\r\n`state=mem:` flag.\r\n\r\nTo avoid updating [every device's netmap](https://tailscale.com/docs/concepts/device-visibility) when an ephemeral device is added to the Tailscale network, consider using an ephemeral [tagged auth key](https://tailscale.com/docs/features/tags#best-practices), and update [access control policies](https://tailscale.com/docs/features/access-control) to restrict what tagged devices can access. If you are deploying multiple instances of the same container, use a [reusable auth key](https://tailscale.com/docs/features/access-control/auth-keys) instead of baking the Tailscale node key into the container image to avoid [duplicate devices](https://tailscale.com/docs/reference/troubleshooting/network-configuration/multiple-devices-same-100.x-ip-address).\r\n\r\nYou can identify ephemeral nodes in the [Machines](https://login.tailscale.com/admin/machines) page of the admin console by looking for an \"Ephemeral\" badge underneath the device name.\r\n\r\n## [Authenticating an ephemeral node](https://tailscale.com/docs/features/ephemeral-nodes\\#authenticating-an-ephemeral-node)\r\n\r\n### [Step 1: Generate an ephemeral auth key](https://tailscale.com/docs/features/ephemeral-nodes\\#step-1-generate-an-ephemeral-auth-key)\r\n\r\nTo create an ephemeral node, you'll first need to generate an ephemeral auth key from the [Keys](https://login.tailscale.com/admin/settings/keys) of the admin console.\r\n\r\n![The Settings page of the admin console with the 'Generate auth key' dialog. The setting for ephemeral keys toggled on.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fephemeral-keys.de85b7fd.png&w=750&q=75)\r\n\r\n**Be careful with auth keys!** These can be very dangerous if stolen.\r\nThey're best kept in a key vault product specially designed for the purpose.\r\n\r\nThe **Pre-approved** option will only display in the dialog if [device approval](https://tailscale.com/docs/features/access-control/device-management/device-approval) is enabled in your Tailscale network.\r\n\r\n### [Step 2: Configure your infrastructure to use the key](https://tailscale.com/docs/features/ephemeral-nodes\\#step-2-configure-your-infrastructure-to-use-the-key)\r\n\r\nThe simplest way to do this is to update your usual scripts to use the new auth key:\r\n\r\n```shell\r\nsudo tailscale up --auth-key=\r\n```\r\n\r\nInstructions vary by platform. Refer to our guides on setting up common platforms:\r\n\r\n- [Tailscale on Heroku](https://tailscale.com/docs/install/cloud/heroku)\r\n- [Tailscale on Google Cloud Run](https://tailscale.com/docs/install/cloud/cloudrun)\r\n- [Tailscale on GitHub Actions](https://tailscale.com/blog/2021-05-github-actions-and-tailscale)\r\n- [Tailscale on AWS Lambda](https://tailscale.com/docs/install/cloud/aws/aws-lambda)\r\n- [Tailscale on Kubernetes](https://tailscale.com/docs/kubernetes)\r\n\r\n### [Step 3: Trigger a build](https://tailscale.com/docs/features/ephemeral-nodes\\#step-3-trigger-a-build)\r\n\r\nThe next time your infrastructure spins up a new device, it appears in the [Machines](https://login.tailscale.com/admin/machines) page of the admin console as an ephemeral node. It will be able to connect to your network, and will be auto-removed shortly after going offline.\r\n\r\n### [FAQ](https://tailscale.com/docs/features/ephemeral-nodes\\#faq)\r\n\r\n#### [Can an ephemeral device remove itself from my tailnet?](https://tailscale.com/docs/features/ephemeral-nodes\\#can-an-ephemeral-device-remove-itself-from-my-tailnet)\r\n\r\nYes. Run the [`tailscale logout`](https://tailscale.com/docs/reference/tailscale-cli#logout) command on an ephemeral device to remove it from your tailnet\r\nimmediately. For example, you can add `tailscale logout` as a last step in your ephemeral node deployment script to immediately remove it from your tailnet\r\nwhen the script completes.\r\n\r\nAnother way is if you created an ephemeral device by running `tailscaled` with the `--state=mem:` flag. If the device is running Tailscale v1.30\r\nor later, when the device exits, the `tailscaled` daemon itself performs `tailscale logout` which immediately removes the device from your tailnet.\r\n\r\n#### [How long before ephemeral devices are auto-removed?](https://tailscale.com/docs/features/ephemeral-nodes\\#how-long-before-ephemeral-devices-are-auto-removed)\r\n\r\nEphemeral devices are auto-removed anywhere normally from 30 to 60 minutes after the last activity. This timeframe is subject to change as we learn more about what works best for Tailscale users. If you want to remove an ephemeral device immediately, run [`tailscale logout`](https://tailscale.com/docs/reference/tailscale-cli#logout) as described above.\r\n\r\n#### [Can I create an ephemeral node without an auth key?](https://tailscale.com/docs/features/ephemeral-nodes\\#can-i-create-an-ephemeral-node-without-an-auth-key)\r\n\r\nYes, running Tailscale v1.22 or later. You can run `tailscaled` with the `--state=mem:` flag. `tailscaled` is the\r\nTailscale daemon that runs on devices that have installed the Tailscale client. The `--state=mem:` flag registers the\r\nnode as an ephemeral node so that the daemon stores state in memory, instead of writing it to disk.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Ephemeral nodes

\n

Last validated: Dec 4, 2025

\n

Ephemeral node usage is included at no cost up to a monthly limit (measured in minutes), which varies by pricing plan.

\n

If an ephemeral node is present in the tailnet for four or more hours, it will not count against your balance of ephemeral minutes, and will count as a standard tagged device instead.

\n

Ephemeral nodes make it easier to connect and then clean up short-lived devices such as containers, cloud functions, or CI/CD systems that spin up and spin down on a regular basis.

\n

By default, when you add a new device to your Tailscale network, it appears in the Machines page of the admin console and in Tailscale client apps. However, short-lived devices can make your network difficult to check, as devices remain in the admin console until removed.

\n

Ephemeral nodes differ from regular nodes in a few ways:

\n\n

To avoid updating every device's netmap when an ephemeral device is added to the Tailscale network, consider using an ephemeral tagged auth key, and update access control policies to restrict what tagged devices can access. If you are deploying multiple instances of the same container, use a reusable auth key instead of baking the Tailscale node key into the container image to avoid duplicate devices.

\n

You can identify ephemeral nodes in the Machines page of the admin console by looking for an \"Ephemeral\" badge underneath the device name.

\n

Authenticating an ephemeral node

\n

Step 1: Generate an ephemeral auth key

\n

To create an ephemeral node, you'll first need to generate an ephemeral auth key from the Keys of the admin console.

\n

\"The

\n

Be careful with auth keys! These can be very dangerous if stolen.\r\nThey're best kept in a key vault product specially designed for the purpose.

\n

The Pre-approved option will only display in the dialog if device approval is enabled in your Tailscale network.

\n

Step 2: Configure your infrastructure to use the key

\n

The simplest way to do this is to update your usual scripts to use the new auth key:

\n
sudo tailscale up --auth-key=<your ephemeral key>\n
\n

Instructions vary by platform. Refer to our guides on setting up common platforms:

\n\n

Step 3: Trigger a build

\n

The next time your infrastructure spins up a new device, it appears in the Machines page of the admin console as an ephemeral node. It will be able to connect to your network, and will be auto-removed shortly after going offline.

\n

FAQ

\n

Can an ephemeral device remove itself from my tailnet?

\n

Yes. Run the tailscale logout command on an ephemeral device to remove it from your tailnet\r\nimmediately. For example, you can add tailscale logout as a last step in your ephemeral node deployment script to immediately remove it from your tailnet\r\nwhen the script completes.

\n

Another way is if you created an ephemeral device by running tailscaled with the --state=mem: flag. If the device is running Tailscale v1.30\r\nor later, when the device exits, the tailscaled daemon itself performs tailscale logout which immediately removes the device from your tailnet.

\n

How long before ephemeral devices are auto-removed?

\n

Ephemeral devices are auto-removed anywhere normally from 30 to 60 minutes after the last activity. This timeframe is subject to change as we learn more about what works best for Tailscale users. If you want to remove an ephemeral device immediately, run tailscale logout as described above.

\n

Can I create an ephemeral node without an auth key?

\n

Yes, running Tailscale v1.22 or later. You can run tailscaled with the --state=mem: flag. tailscaled is the\r\nTailscale daemon that runs on devices that have installed the Tailscale client. The --state=mem: flag registers the\r\nnode as an ephemeral node so that the daemon stores state in memory, instead of writing it to disk.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}