Manage expiry and device approval

The auth key gets a device in the door. The node key is the device’s ongoing WireGuard identity, and it expires on its own schedule, 180 days by default.

The two are independent. A device enrolled with a one-off key that died an hour later still has a node key that lives for months. When that node key expires, the device drops out of the tailnet until someone reauthenticates it:

sudo tailscale up --force-reauth

This opens the browser login again. For laptops and phones, expiry is a feature. A device that left the company, or a tablet lost on a train, stops being a tailnet member on a schedule, even if nobody remembers to remove it.

Where expiry hurts

Nobody wants the production subnet router dropping offline at day 180, waiting for a browser login that no one is around to complete. So tagged infrastructure normally has key expiry disabled.

The trade is explicit. The machine never expires, so humans must do the reviewing that expiry would have forced. Check last-seen times. Retire replaced hardware. Treat the Machines list as an inventory you own, not a log you glance at.

You can also disable expiry per device in the admin console. Reserve that for infrastructure, never for personal devices. A laptop with expiry disabled is a laptop that stays in your tailnet forever.

Device approval

Device approval adds an administrator check before a new device can exchange tailnet traffic. Enable it under Settings, Device management. From then on, every new enrollment waits until an admin reviews it.

Valid credentials stop being enough. A human confirms the device belongs. This is the control that catches a stolen reusable key: the attacker enrolls, the device sits in the queue, and you see a machine you do not recognize.

Preapproved auth keys skip the queue. That is right for infrastructure enrolled through your deployment pipeline, where the approval effectively happened when someone created the key.

Practice the lifecycle

Enable device approval in your practice tailnet. Enroll one device and watch it wait. Review its identity in the console, approve it, and confirm it can talk. Then revoke it and confirm traffic stops:

tailscale ping lab-tablet
# succeeds while approved, fails after revocation

Revocation is the step nobody rehearses. Do it once calmly, in the lab, so the first real one is not also the first attempt. When a laptop goes missing, you want your hands to already know where the button is.