{"slug":"key-expiry","title":"Key expiry","tags":["tailscale","access-control"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Key expiry\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nAs a security feature, users need to periodically reauthenticate on\r\neach of their devices. The default expiration period depends on your\r\ndomain setting. By default, new domains are set with an expiry period\r\nof 180 days.\r\n\r\nIf reauthentication does not occur, keys expire and connections to/from the\r\ngiven endpoint will stop working.\r\n\r\n## [Disabling key expiry](https://tailscale.com/docs/features/access-control/key-expiry\\#disabling-key-expiry)\r\n\r\nDisabling key expiryis available for [all plans](https://tailscale.com/pricing).\r\n\r\nYou may want to disable key expiry on some devices, such as trusted servers, [subnet routers](https://tailscale.com/docs/features/subnet-routers), or remote IoT devices that are hard to reach.\r\n\r\n1. Open the [Machines](https://login.tailscale.com/admin/machines) page of the admin console.\r\n2. Find the row corresponding to the device you are interested in.\r\n3. Select the ![ellipsis icon](https://tailscale.com/files/images/icons/fa-ellipsis-h.svg) menu at the far right and select the **Disable Key Expiry** option:![Menu in the admin console with the 'Disable Key Expiry' option indicated with a red outline.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fdisable-key-expiry.4683b4d2.png&w=1200&q=75)\r\n4. Done. The keys for that device will no longer expire.\r\n\r\n## [Enabling key expiry](https://tailscale.com/docs/features/access-control/key-expiry\\#enabling-key-expiry)\r\n\r\nEnabling key expiryis available for [all plans](https://tailscale.com/pricing).\r\n\r\n1. Open the [Machines](https://login.tailscale.com/admin/machines) page of the admin console.\r\n2. Find the row corresponding to the device you are interested in.\r\n3. Select the ![ellipsis icon](https://tailscale.com/files/images/icons/fa-ellipsis-h.svg) menu at the far right and select the **Enable Key Expiry** option:\r\n4. Done. The keys for that device are now set with an expiration.\r\n\r\n## [Renewing keys for an expired device](https://tailscale.com/docs/features/access-control/key-expiry\\#renewing-keys-for-an-expired-device)\r\n\r\nIf keys expire for a device, connections to/from the given endpoint will stop working. For devices that\r\nhave the [Tailscale CLI](https://tailscale.com/docs/reference/tailscale-cli), running [`tailscale up --force-reauth`](https://tailscale.com/docs/reference/tailscale-cli/up) (using `sudo` if needed)\r\nwill renew the keys.\r\n\r\nBe aware that `tailscale up --force-reauth` might bring down the tailnet connection and thus should not be done remotely over SSH or RDP without an alternate means to log in if the connection is lost.\r\n\r\nHowever, for remote devices that you've [restricted to Tailscale-only traffic](https://tailscale.com/docs/how-to/secure-ubuntu-server-with-ufw), signing in again without Tailscale access can be difficult or impossible. In these cases, we allow admins of a network to temporarily extend a key's lifetime to help the device owner regain access and reauthenticate.\r\n\r\nTo regain access to an expired device:\r\n\r\n1. Open the [Machines](https://login.tailscale.com/admin/machines) page of the admin console.\r\n2. Find the row corresponding to the device you are interested in.\r\n3. Select the ![ellipsis icon](https://tailscale.com/files/images/icons/fa-ellipsis-h.svg) menu at the far right and select the **Temporarily extend key** option. This option only appears for devices with expired keys:![Menu in the admin console with the 'Temporarily Extend Key' option indicated with a red outline.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fextend-key-expiry.1426d027.png&w=1200&q=75)\r\n4. The key will be extended for 30 minutes. Instruct the owner of the machine to log in and reauthenticate within the extended timeframe, or disable key expiry for this device within that window.\r\n5. Once the machine has been reauthenticated, the key should be renewed for your standard expiry time (6 months by default).\r\n\r\nIf you're renewing keys for a machine that belongs to you, and it has already signed a new authentication URL, we provide a one-select **Reauthenticate** option in place of **Temporarily extend key**. However, extending the key is the far more common way to regain access.\r\n\r\n## [Using key expiry with tagged devices](https://tailscale.com/docs/features/access-control/key-expiry\\#using-key-expiry-with-tagged-devices)\r\n\r\nWhen you apply a tag to a device for the first time and authenticate it, the tagged device will have [key expiry](https://tailscale.com/docs/features/access-control/key-expiry) disabled by default. For more information, refer to [Key expiry for tagged devices](https://tailscale.com/docs/features/tags#key-expiry).\r\n\r\n## [Setting a custom authentication period](https://tailscale.com/docs/features/access-control/key-expiry\\#setting-a-custom-authentication-period)\r\n\r\nSetting a custom authentication periodis available for [all plans](https://tailscale.com/pricing).\r\n\r\n1. Open the [Device management](https://login.tailscale.com/admin/settings/device-management) page of the admin console.\r\n2. In the **Key Expiry** section, select from 1 to 180 days as the custom authentication period.\r\n3. Select **Save**.\r\n\r\nA change to the **Key Expiry** value applies to any devices that are logged in after you make the change. The key expiration for any devices that are already logged in remains unchanged, until the next time the device is logged in.\r\n\r\n## [Admin console session expiry](https://tailscale.com/docs/features/access-control/key-expiry\\#admin-console-session-expiry)\r\n\r\nA browser session that is accessing the Tailscale [admin console](https://login.tailscale.com/admin) has an expiry of 30 days. This expiry is unrelated to any key expiry. For more information, refer to the topic [Do admin console sessions expire?](https://tailscale.com/docs/reference/admin-console-session-expiry)\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Key expiry

\n

Last validated: Jan 5, 2026

\n

As a security feature, users need to periodically reauthenticate on\r\neach of their devices. The default expiration period depends on your\r\ndomain setting. By default, new domains are set with an expiry period\r\nof 180 days.

\n

If reauthentication does not occur, keys expire and connections to/from the\r\ngiven endpoint will stop working.

\n

Disabling key expiry

\n

Disabling key expiryis available for all plans.

\n

You may want to disable key expiry on some devices, such as trusted servers, subnet routers, or remote IoT devices that are hard to reach.

\n
    \n
  1. Open the Machines page of the admin console.
    2. \n
  2. Find the row corresponding to the device you are interested in.
    3. \n
  3. Select the \"ellipsis menu at the far right and select the Disable Key Expiry option:\"Menu
    4. \n
  4. Done. The keys for that device will no longer expire.
    5. \n
\n

Enabling key expiry

\n

Enabling key expiryis available for all plans.

\n
    \n
  1. Open the Machines page of the admin console.
    2. \n
  2. Find the row corresponding to the device you are interested in.
    3. \n
  3. Select the \"ellipsis menu at the far right and select the Enable Key Expiry option:
    4. \n
  4. Done. The keys for that device are now set with an expiration.
    5. \n
\n

Renewing keys for an expired device

\n

If keys expire for a device, connections to/from the given endpoint will stop working. For devices that\r\nhave the Tailscale CLI, running tailscale up --force-reauth (using sudo if needed)\r\nwill renew the keys.

\n

Be aware that tailscale up --force-reauth might bring down the tailnet connection and thus should not be done remotely over SSH or RDP without an alternate means to log in if the connection is lost.

\n

However, for remote devices that you've restricted to Tailscale-only traffic, signing in again without Tailscale access can be difficult or impossible. In these cases, we allow admins of a network to temporarily extend a key's lifetime to help the device owner regain access and reauthenticate.

\n

To regain access to an expired device:

\n
    \n
  1. Open the Machines page of the admin console.
    2. \n
  2. Find the row corresponding to the device you are interested in.
    3. \n
  3. Select the \"ellipsis menu at the far right and select the Temporarily extend key option. This option only appears for devices with expired keys:\"Menu
    4. \n
  4. The key will be extended for 30 minutes. Instruct the owner of the machine to log in and reauthenticate within the extended timeframe, or disable key expiry for this device within that window.
    5. \n
  5. Once the machine has been reauthenticated, the key should be renewed for your standard expiry time (6 months by default).
    6. \n
\n

If you're renewing keys for a machine that belongs to you, and it has already signed a new authentication URL, we provide a one-select Reauthenticate option in place of Temporarily extend key. However, extending the key is the far more common way to regain access.

\n

Using key expiry with tagged devices

\n

When you apply a tag to a device for the first time and authenticate it, the tagged device will have key expiry disabled by default. For more information, refer to Key expiry for tagged devices.

\n

Setting a custom authentication period

\n

Setting a custom authentication periodis available for all plans.

\n
    \n
  1. Open the Device management page of the admin console.
    2. \n
  2. In the Key Expiry section, select from 1 to 180 days as the custom authentication period.
    3. \n
  3. Select Save.
    4. \n
\n

A change to the Key Expiry value applies to any devices that are logged in after you make the change. The key expiration for any devices that are already logged in remains unchanged, until the next time the device is logged in.

\n

Admin console session expiry

\n

A browser session that is accessing the Tailscale admin console has an expiry of 30 days. This expiry is unrelated to any key expiry. For more information, refer to the topic Do admin console sessions expire?

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}