tailscale_create_key
Create auth keys, OAuth clients, or federated identities for your tailnet. Supports devices, API access, and OIDC-based CI/CD. Save the returned value immediately.
Instructions
Create a new key in your tailnet. Supports auth keys (for adding devices), OAuth clients (for programmatic API access), and federated identities (for OIDC-based CI/CD access). Returns the key value — save it immediately, as it cannot be retrieved again.
SECURITY: the response body contains a long-lived credential verbatim. MCP clients commonly persist tool responses to logs and conversation transcripts; treat this response as sensitive (do not commit it, avoid re-sharing it in unrelated chat history).
Examples:
Auth key: {keyType:'auth', reusable:true, tags:['tag:ci']}
OAuth client: {keyType:'client', scopes:['devices:read','dns']}
Federated (GitHub Actions): {keyType:'federated', scopes:['devices:read'], issuer:'https://token.actions.githubusercontent.com', subject:'repo:my-org/my-repo:*'}
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | ACL tags (must start with 'tag:'). Required for client/federated if scopes include 'devices:core' or 'auth_keys' | |
| issuer | No | (federated only) OIDC issuer URL (e.g. 'https://token.actions.githubusercontent.com') | |
| scopes | No | (client/federated) OAuth scopes to grant (e.g. ['devices:read', 'dns', 'acl']) | |
| keyType | No | Key type: 'auth' (default) for device auth keys, 'client' for OAuth clients, 'federated' for OIDC federation | |
| subject | No | (federated only) Expected subject claim, supports * wildcards | |
| audience | No | (federated only) Expected audience claim | |
| reusable | No | (auth only) Whether the key can be used more than once (default: false) | |
| ephemeral | No | (auth only) Whether devices using this key are ephemeral (default: false) | |
| description | No | Description for this key (max 50 chars, alphanumeric/hyphens/spaces) | |
| expirySeconds | No | (auth only) Key expiry in seconds (default: 90 days) | |
| preauthorized | No | (auth only) Whether devices are pre-authorized (default: false) | |
| customClaimRules | No | (federated only) Custom claim mapping rules |