Choose an authentication method

A person can open a browser and log in. An unattended server, a container, or a CI runner cannot. Those need a way to join the tailnet without anyone clicking.

Interactive login is the right default for anything with a human at the keyboard. The identity provider does the work, second factors apply, and the resulting node belongs to that person. The real decisions start when nobody is there to click.

The non-interactive options

An auth key is a credential that enrolls a device without a browser login. You create it in the admin console and pass it to tailscale up:

sudo tailscale up --auth-key=tskey-auth-kFJb851CNTRL-example

The command returns immediately, with no URL to visit. There are several kinds of key, and the kind matters more than people think.

A one-off key enrolls exactly one node, then becomes useless. Stolen after use, it is worth nothing. This is the safest default for one server.

A reusable key can enroll many nodes. That is convenient and dangerous. Anyone holding it can add devices to your tailnet until it expires or you revoke it. If you must use one, give it a short expiry and treat it like a root password.

An ephemeral key creates nodes that disappear after going offline. A CI runner that lives for one build has no business leaving a permanent tailnet entry behind. Create the key with the ephemeral option and cleanup happens on its own.

Tags can be attached to any key type. The node’s identity becomes tag:ci or tag:server instead of a person, and policy targets the role. Always tag machines enrolled by a key.

Classify your fleet

Take four machines: a laptop, a long-lived server, an autoscaled runner, and a CI job. For each, choose interactive login, one-off key, reusable key, or ephemeral enrollment.

My answers. Laptop: interactive login. Long-lived server: one-off key with a tag. Autoscaled runners: ephemeral tagged keys minted by automation, which is the topic of a later lesson. CI job: ephemeral tagged key, so each run enrolls fresh and vanishes after.

The failure mode to avoid

One reusable key pasted into five places “temporarily”. Six months later nobody remembers where it went, and revoking it breaks something unknown.

Choose the key type that matches the machine’s lifespan. A machine that lives for years gets a key used once. A machine that lives for minutes gets a key that dies with it.