Skip to main content
Only an Owner, Admin, Network admin or IT admin can create an OAuth client.

​
Create the OAuth client

An OAuth client belongs to your tailnet, not to a person. It keeps working after its creator leaves the tailnet, and the access tokens it creates last one hour and renew automatically.

1

Sign in to Tailscale

Sign in to your Tailscale admin console.

2

Start the credential

Select the Credential button, then select OAuth.

3

Choose the scopes

Select Read for the all:read scope. Select nothing else unless you need the user actions below.

  • The connection test lists users, groups and pending invitations. Tailscale’s scope list names no scope for pending invitations, so the client needs all:read, which reads the whole tailnet.
  • all:read cannot change anything. Besides users and groups, it reads devices and routes, DNS, audit and network flow logs, webhooks, tailnet settings and contacts, and the list of every access token in the tailnet, plus any read API Tailscale adds later.
  • all:read includes users:read, policy_file:read, devices:posture_attributes:read and devices:core:read. You do not need to select them.
  • Add users (write) only to use the native actions that suspend, restore, approve, delete or change the role of users. Leave it out to keep the connection read-only. A Network admin cannot grant users, so an Owner, Admin or IT admin must create the client.
4

Generate the credential

Select Generate credential.

5

Copy the client ID and the client secret

On the Credential created page, copy the client ID and the client secret, store them securely for use later, then select Done.

  • The client secret is shown once and cannot be copied again after you close the Credential created page.
  • The client secret starts with tskey-client- and is case-sensitive.
  • Paste the client ID into the OAuth Client ID field and the client secret into the OAuth Client Secret field in StackOne Hub.

​
Know how long the client lasts

Tailscale OAuth clients do not expire. The client works until you revoke it.

  • To stop StackOne from reading your tailnet, open the Trust credentials page, find the credential, and select Revoke. Select Revoke again to confirm.
  • Revoking the credential also revokes the access tokens it created, and the connection stops working until you paste a new client ID and secret into StackOne Hub.

​
Linking the Account from the Hub

1

Navigate to the Hub

Use one of the three Linking Account Methods to access the Hub.
2

Fill out the fields

Fill out the following fields using details from your provider:
  • OAuth Client ID
  • OAuth Client Secret
3

Connect

  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account on your Accounts page.