{"slug":"get-started-with-aperture","title":"Get started with Aperture","tags":["tailscale","setup"],"agent_summary":"Last validated: Apr 9, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Get started with Aperture\r\n\r\nLast validated: Apr 9, 2026\r\n\r\nAperture by Tailscaleis currently [in alpha](https://tailscale.com/docs/reference/tailscale-release-stages#alpha).\r\n\r\nDuring the alpha testing period, Aperture by Tailscale is available at no additional cost with any Tailscale account, including free accounts created during Aperture signup. Request access at [`aperture.tailscale.com`](https://aperture.tailscale.com/).\r\n\r\n## [Requirements](https://tailscale.com/docs/aperture/get-started\\#requirements)\r\n\r\nBefore deploying Aperture, ensure your environment meets these requirements.\r\n\r\n- **One or more LLM provider accounts**\r\n\r\nYou need API keys for any LLM providers to route through Aperture. Aperture supports the following providers:\r\n\r\n\r\n - OpenAI (GPT-4o, o1, o3-mini, and other models)\r\n - Anthropic (Claude Sonnet, Claude Opus, and other models)\r\n - Google (Gemini models)\r\n - OpenRouter (provides access to open source models such as DeepSeek, Qwen, and others)\r\n - OpenAI-compatible APIs (for example, llama.cpp and other self-hosted endpoints)\r\n\r\nAperture requires API keys from provider developer platforms. Consumer and business subscription plans — such as [Claude Pro or Claude Max](https://www.anthropic.com/pricing), [ChatGPT Plus, Pro, or Team](https://openai.com/chatgpt/pricing), or [Gemini Advanced](https://gemini.google.com/) — do not provide API keys and are not compatible with Aperture.\r\n\r\n- **A Tailscale account**\r\n\r\nThe Aperture server runs on a Tailscale network (tailnet). When you [sign up for Aperture](https://aperture.tailscale.com/), the process creates a free Tailscale account for you if you don't already have one.\r\n\r\nAperture uses [Tailscale identity](https://tailscale.com/docs/concepts/tailscale-identity) to authenticate users automatically. When a client connects, the proxy identifies the user by their login name and device. This enables API access without distributing keys to individual users because Aperture centrally manages provider credentials and injects them when forwarding requests.\r\n\r\n- **Client connectivity**\r\n\r\nClients can connect to Aperture in two ways:\r\n - **From inside the tailnet (recommended)**: Clients on the same tailnet as Aperture get full per-user identity, zero-key authentication, and granular access controls. Install Tailscale on each client device to join the tailnet.\r\n - **From outside the tailnet**: Clients that are not in the tailnet can use the [ts-unplug](https://github.com/tailscale/ts-plug) tool, which creates a lightweight tailnet device and proxies local traffic to the Aperture instance. Each ts-unplug instance authenticates as a single tailnet identity. If each person runs their own ts-unplug, they get individual user attribution. Refer to [enable Aperture without a tailnet](https://tailscale.com/docs/aperture/get-started#enable-aperture-without-a-tailnet) for setup instructions.\r\n\r\n## [Sign up](https://tailscale.com/docs/aperture/get-started\\#sign-up)\r\n\r\nAperture by Tailscale is a managed service that Tailscale hosts and maintains. To create an Aperture instance, visit [`aperture.tailscale.com`](https://aperture.tailscale.com/) and complete the sign-up process. If you don't have a Tailscale account, the sign-up process creates a free one for you.\r\n\r\nAfter you have access to Aperture, follow the remaining sections on this page to configure providers and test your setup, then proceed to grant user access and connect LLM clients.\r\n\r\n## [Configure Aperture settings](https://tailscale.com/docs/aperture/get-started\\#configure-aperture-settings)\r\n\r\nTo configure [Aperture settings](https://tailscale.com/docs/aperture/configuration), go to the Aperture dashboard. The Aperture dashboard is available to devices in the same tailnet at `http://ai/ui`. If you connect through ts-unplug, access the interface at `http://localhost:/ui/`.\r\n\r\n1. Open the **Settings** page of the Aperture dashboard.\r\n2. Update the Aperture configuration to include the LLM providers and models you plan to use.\r\n3. Configure any additional settings.\r\n\r\nThe following example configures Aperture with access to Anthropic's Claude Sonnet 4.5 and Claude Opus 4.5 models.\r\n\r\n```json\r\n{\r\n \"providers\": {\r\n \"anthropic\": {\r\n \"baseurl\": \"https://api.anthropic.com\",\r\n \"apikey\": \"YOUR_ANTHROPIC_API_KEY\",\r\n \"models\": [\\\r\n \"claude-sonnet-4-5\",\\\r\n \"claude-opus-4-5\",\\\r\n ],\r\n \"authorization\": \"x-api-key\",\r\n \"compatibility\": {\r\n \"anthropic_messages\": true,\r\n }\r\n }\r\n }\r\n}\r\n```\r\n\r\nIf you don't customize the Aperture configuration, Aperture uses [the default configuration](https://tailscale.com/docs/aperture/configuration#default-configuration). Refer to the [Aperture configuration reference](https://tailscale.com/docs/aperture/configuration) for details on all available settings.\r\n\r\n## [Test your Aperture configuration](https://tailscale.com/docs/aperture/get-started\\#test-your-aperture-configuration)\r\n\r\nAfter configuring providers, test your connection using curl commands from a device connected to the tailnet. If you connect through ts-unplug, use `http://localhost:` instead of `http://ai`.\r\n\r\n**Test Anthropic API format**:\r\n\r\n```shell\r\ncurl -s http://ai/v1/messages \\\r\n -H \"Content-Type: application/json\" \\\r\n -d '{\r\n \"model\": \"claude-haiku-4-5-20251001\",\r\n \"max_tokens\": 25,\r\n \"messages\": [{\"role\": \"user\", \"content\": \"respond with: hello\"}]\r\n }'\r\n```\r\n\r\n**Test OpenAI API format**:\r\n\r\n```shell\r\ncurl -s http://ai/v1/chat/completions \\\r\n -H \"Content-Type: application/json\" \\\r\n -d '{\r\n \"model\": \"gpt-4o\",\r\n \"messages\": [{\"role\": \"user\", \"content\": \"respond with: hello\"}]\r\n }'\r\n```\r\n\r\n**Test OpenAI Responses API format**:\r\n\r\n```shell\r\ncurl -s http://ai/v1/responses \\\r\n -H \"Content-Type: application/json\" \\\r\n -d '{\r\n \"model\": \"gpt-4o\",\r\n \"input\": [{\"role\": \"user\", \"content\": \"respond with: hello\"}]\r\n }'\r\n```\r\n\r\nIf the requests succeed, Aperture is correctly routing to your configured providers. Visit the [Aperture dashboard](https://tailscale.com/docs/aperture/reference/dashboard) at `http://ai/ui/` to see the requests in your usage history.\r\n\r\n## [Next steps](https://tailscale.com/docs/aperture/get-started\\#next-steps)\r\n\r\nAfter configuring and testing Aperture:\r\n\r\n1. [Grant users access to models](https://tailscale.com/docs/aperture/how-to/grant-model-access) so they can send requests.\r\n2. [Set up your LLM clients](https://tailscale.com/docs/aperture/use-your-tools) to route traffic through Aperture.\r\n3. (Optional) [Set spending limits](https://tailscale.com/docs/aperture/manage-spending) to control costs.\r\n\r\nIf your team members are not in the tailnet, they can connect to Aperture using [ts-unplug](https://github.com/tailscale/ts-plug). Refer to [enable Aperture without a tailnet](https://tailscale.com/docs/aperture/get-started#enable-aperture-without-a-tailnet) for setup instructions.\r\n\r\n## [Enable Aperture without a tailnet](https://tailscale.com/docs/aperture/get-started\\#enable-aperture-without-a-tailnet)\r\n\r\nYou can use Aperture from a device that is not on the same tailnet as the Aperture deployment using the [`ts-plug` and `ts-unplug` tools](https://github.com/tailscale/ts-plug).\r\n\r\nThe `ts-plug` and `ts-unplug` tools are under active development. Refer to the [ts-plug repository](https://github.com/tailscale/ts-plug) for the latest status.\r\n\r\nEach ts-unplug instance authenticates as a single tailnet identity. If each person runs their own ts-unplug, Aperture attributes the activity to individual users. If multiple people share a single ts-unplug instance, all activity appears under a single identity.\r\n\r\nTo set up `ts-unplug` on a device:\r\n\r\n1. Clone the [`ts-plug` repository](https://github.com/tailscale/ts-plug) from GitHub.\r\n2. Build the `ts-unplug` application:\r\n1. Run `make ts-unplug`.\r\n2. Run `make install`.\r\n3. Run the `ts-unplug` command to link to the Aperture proxy instance. Use the fully qualified domain name (FQDN) of the Aperture proxy and an available and accessible port number (for example, port `9996`).\r\n\r\n```shell\r\nts-unplug -dir ./state -port ai..ts.net\r\n```\r\n\r\nNext, approve the device in the [Machines](https://login.tailscale.com/admin/machines) of the admin console for the tailnet hosting Aperture. After you approve it, users on that device can access Aperture from `http://localhost:`.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Get started with Aperture

\n

Last validated: Apr 9, 2026

\n

Aperture by Tailscaleis currently in alpha.

\n

During the alpha testing period, Aperture by Tailscale is available at no additional cost with any Tailscale account, including free accounts created during Aperture signup. Request access at aperture.tailscale.com.

\n

Requirements

\n

Before deploying Aperture, ensure your environment meets these requirements.

\n
    \n
  • One or more LLM provider accounts
    • \n
\n

You need API keys for any LLM providers to route through Aperture. Aperture supports the following providers:

\n
    \n
  • OpenAI (GPT-4o, o1, o3-mini, and other models)
    • \n
  • Anthropic (Claude Sonnet, Claude Opus, and other models)
    • \n
  • Google (Gemini models)
    • \n
  • OpenRouter (provides access to open source models such as DeepSeek, Qwen, and others)
    • \n
  • OpenAI-compatible APIs (for example, llama.cpp and other self-hosted endpoints)
    • \n
\n

Aperture requires API keys from provider developer platforms. Consumer and business subscription plans — such as Claude Pro or Claude Max, ChatGPT Plus, Pro, or Team, or Gemini Advanced — do not provide API keys and are not compatible with Aperture.

\n
    \n
  • A Tailscale account
    • \n
\n

The Aperture server runs on a Tailscale network (tailnet). When you sign up for Aperture, the process creates a free Tailscale account for you if you don't already have one.

\n

Aperture uses Tailscale identity to authenticate users automatically. When a client connects, the proxy identifies the user by their login name and device. This enables API access without distributing keys to individual users because Aperture centrally manages provider credentials and injects them when forwarding requests.

\n
    \n
  • Client connectivity
    • \n
\n

Clients can connect to Aperture in two ways:

\n
    \n
  • From inside the tailnet (recommended): Clients on the same tailnet as Aperture get full per-user identity, zero-key authentication, and granular access controls. Install Tailscale on each client device to join the tailnet.
    • \n
  • From outside the tailnet: Clients that are not in the tailnet can use the ts-unplug tool, which creates a lightweight tailnet device and proxies local traffic to the Aperture instance. Each ts-unplug instance authenticates as a single tailnet identity. If each person runs their own ts-unplug, they get individual user attribution. Refer to enable Aperture without a tailnet for setup instructions.
    • \n
\n

Sign up

\n

Aperture by Tailscale is a managed service that Tailscale hosts and maintains. To create an Aperture instance, visit aperture.tailscale.com and complete the sign-up process. If you don't have a Tailscale account, the sign-up process creates a free one for you.

\n

After you have access to Aperture, follow the remaining sections on this page to configure providers and test your setup, then proceed to grant user access and connect LLM clients.

\n

Configure Aperture settings

\n

To configure Aperture settings, go to the Aperture dashboard. The Aperture dashboard is available to devices in the same tailnet at http://ai/ui. If you connect through ts-unplug, access the interface at http://localhost:<PORT_NUMBER>/ui/.

\n
    \n
  1. Open the Settings page of the Aperture dashboard.
    2. \n
  2. Update the Aperture configuration to include the LLM providers and models you plan to use.
    3. \n
  3. Configure any additional settings.
    4. \n
\n

The following example configures Aperture with access to Anthropic's Claude Sonnet 4.5 and Claude Opus 4.5 models.

\n
{\r\n  \"providers\": {\r\n    \"anthropic\": {\r\n      \"baseurl\": \"https://api.anthropic.com\",\r\n      \"apikey\": \"YOUR_ANTHROPIC_API_KEY\",\r\n      \"models\": [\\\r\n        \"claude-sonnet-4-5\",\\\r\n        \"claude-opus-4-5\",\\\r\n      ],\r\n      \"authorization\": \"x-api-key\",\r\n      \"compatibility\": {\r\n        \"anthropic_messages\": true,\r\n      }\r\n    }\r\n  }\r\n}\n
\n

If you don't customize the Aperture configuration, Aperture uses the default configuration. Refer to the Aperture configuration reference for details on all available settings.

\n

Test your Aperture configuration

\n

After configuring providers, test your connection using curl commands from a device connected to the tailnet. If you connect through ts-unplug, use http://localhost:<PORT_NUMBER> instead of http://ai.

\n

Test Anthropic API format:

\n
curl -s http://ai/v1/messages \\\r\n  -H \"Content-Type: application/json\" \\\r\n  -d '{\r\n    \"model\": \"claude-haiku-4-5-20251001\",\r\n    \"max_tokens\": 25,\r\n    \"messages\": [{\"role\": \"user\", \"content\": \"respond with: hello\"}]\r\n  }'\n
\n

Test OpenAI API format:

\n
curl -s http://ai/v1/chat/completions \\\r\n  -H \"Content-Type: application/json\" \\\r\n  -d '{\r\n    \"model\": \"gpt-4o\",\r\n    \"messages\": [{\"role\": \"user\", \"content\": \"respond with: hello\"}]\r\n  }'\n
\n

Test OpenAI Responses API format:

\n
curl -s http://ai/v1/responses \\\r\n  -H \"Content-Type: application/json\" \\\r\n  -d '{\r\n    \"model\": \"gpt-4o\",\r\n    \"input\": [{\"role\": \"user\", \"content\": \"respond with: hello\"}]\r\n  }'\n
\n

If the requests succeed, Aperture is correctly routing to your configured providers. Visit the Aperture dashboard at http://ai/ui/ to see the requests in your usage history.

\n

Next steps

\n

After configuring and testing Aperture:

\n
    \n
  1. Grant users access to models so they can send requests.
    2. \n
  2. Set up your LLM clients to route traffic through Aperture.
    3. \n
  3. (Optional) Set spending limits to control costs.
    4. \n
\n

If your team members are not in the tailnet, they can connect to Aperture using ts-unplug. Refer to enable Aperture without a tailnet for setup instructions.

\n

Enable Aperture without a tailnet

\n

You can use Aperture from a device that is not on the same tailnet as the Aperture deployment using the ts-plug and ts-unplug tools.

\n

The ts-plug and ts-unplug tools are under active development. Refer to the ts-plug repository for the latest status.

\n

Each ts-unplug instance authenticates as a single tailnet identity. If each person runs their own ts-unplug, Aperture attributes the activity to individual users. If multiple people share a single ts-unplug instance, all activity appears under a single identity.

\n

To set up ts-unplug on a device:

\n
    \n
  1. Clone the ts-plug repository from GitHub.
    2. \n
  2. Build the ts-unplug application:
    3. \n
  3. Run make ts-unplug.
    4. \n
  4. Run make install.
    5. \n
  5. Run the ts-unplug command to link to the Aperture proxy instance. Use the fully qualified domain name (FQDN) of the Aperture proxy and an available and accessible port number (for example, port 9996).
    6. \n
\n
ts-unplug -dir ./state -port <PORT_NUMBER> ai.<YOUR_TAILNET_ID>.ts.net\n
\n

Next, approve the device in the Machines of the admin console for the tailnet hosting Aperture. After you approve it, users on that device can access Aperture from http://localhost:<PORT_NUMBER>.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}