Choose one-off or reusable Tailscale enrollment keys deliberately

A reusable key can enroll multiple nodes, so its custody and replacement plan must match that reach.

Source facts

Tailscale auth keys enroll devices without an interactive browser sign-in. A one-off key can be used once, and Tailscale automatically revokes it after use. A reusable key can enroll multiple devices, so Tailscale warns that theft can be dangerous and recommends purpose-built secret storage. The administrator sets the key’s enrollment lifetime within the documented range and must generate a new key after expiry. That enrollment-key lifetime is distinct from the node keys generated by devices that have already joined.

Source: Tailscale — Auth keys.

Applicability

This concerns Tailscale enrollment auth keys for unattended provisioning. It does not describe general API tokens, OAuth client credentials, or a guarantee that an expired enrollment key removes existing nodes.

DSE recommendation

DSE recommends choosing the credential shape from the provisioning task. Use a one-off key when one enrollment is intended and automation can obtain a fresh credential for the next device. If a reusable key is operationally necessary, document the expected node population, authorized provisioning system, storage location, and replacement owner. Set an expiry that fits the approved rollout rather than leaving an unreviewed deployment secret in a script. Keep key values out of images, repositories, tickets, and diagnostic output.

Verification

In a disposable provisioning test, confirm that a one-off key cannot enroll a second node after its first use. Separately verify the intended reusable-key workflow and its expiry handling. Reconcile the resulting devices with the rollout record and remove all test nodes after the exercise.

Official reference

Tailscale — Auth keys. Reviewed October 15, 2026.