# Choose one-off or reusable Tailscale enrollment keys deliberately

> A reusable key can enroll multiple nodes, so its custody and replacement plan must match that reach.

- Canonical URL: https://update.dsesecurity.com/updates/tailscale-auth-key-one-off-reusable-provisioning-choice/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:33:14+00:00
- Modified: 2026-10-15T13:36:16+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A reusable key can enroll multiple nodes, so its custody and replacement plan must match that reach.

## Potentially affected

This concerns Tailscale enrollment auth keys for unattended provisioning. It does not describe general API tokens, OAuth client credentials, or a guarantee that an expired enrollment key removes existing nodes.

## DSE recommendation

DSE recommends choosing the credential shape from the provisioning task.

## Article

A reusable key can enroll multiple nodes, so its custody and replacement plan must match that reach.

## Source facts

Tailscale auth keys enroll devices without an interactive browser sign-in. A one-off key can be used once, and Tailscale automatically revokes it after use. A reusable key can enroll multiple devices, so Tailscale warns that theft can be dangerous and recommends purpose-built secret storage. The administrator sets the key’s enrollment lifetime within the documented range and must generate a new key after expiry. That enrollment-key lifetime is distinct from the node keys generated by devices that have already joined.

Source: [Tailscale — Auth keys](https://tailscale.com/docs/features/access-control/auth-keys).

## Applicability

This concerns Tailscale enrollment auth keys for unattended provisioning. It does not describe general API tokens, OAuth client credentials, or a guarantee that an expired enrollment key removes existing nodes.

## DSE recommendation

DSE recommends choosing the credential shape from the provisioning task. Use a one-off key when one enrollment is intended and automation can obtain a fresh credential for the next device. If a reusable key is operationally necessary, document the expected node population, authorized provisioning system, storage location, and replacement owner. Set an expiry that fits the approved rollout rather than leaving an unreviewed deployment secret in a script. Keep key values out of images, repositories, tickets, and diagnostic output.

## Verification

In a disposable provisioning test, confirm that a one-off key cannot enroll a second node after its first use. Separately verify the intended reusable-key workflow and its expiry handling. Reconcile the resulting devices with the rollout record and remove all test nodes after the exercise.

## Official reference

[Tailscale — Auth keys](https://tailscale.com/docs/features/access-control/auth-keys). Reviewed October 15, 2026.

## Primary reference

- Name: Tailscale — Auth keys
- Authority: tailscale.com
- URL: https://tailscale.com/docs/features/access-control/auth-keys
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose one-off or reusable Tailscale enrollment keys deliberately,” DSE Security, https://update.dsesecurity.com/updates/tailscale-auth-key-one-off-reusable-provisioning-choice/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.