> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Tailscale with OAuth 2.0 (Client Credentials) – StackOne Hub

> Link a Tailscale account in the StackOne Hub using OAuth 2.0 (Client Credentials). End-user guide to authorize the integration and start using Tailscale actions.

> [!WARNING]
>
> Only an Owner, Admin, Network admin or IT admin can create an OAuth client.

## Create the OAuth client

An OAuth client belongs to your tailnet, not to a person. It keeps working after its creator leaves the tailnet, and the access tokens it creates last one hour and renew automatically.

**1. Sign in to Tailscale**

Sign in to your [Tailscale admin console](https://console.tailscale.com/admin).

<ul>
  <li>Open the [Trust credentials](https://console.tailscale.com/admin/settings/trust-credentials) page.</li>
</ul>

**2. Start the credential**

Select the **Credential** button, then select **OAuth**.

**3. Choose the scopes**

Select **Read** for the `all:read` scope. Select nothing else unless you need the user actions below.

<ul>
  <li>The connection test lists users, groups and pending invitations. Tailscale's scope list names no scope for pending invitations, so the client needs `all:read`, which reads the whole tailnet.</li>
  <li>`all:read` cannot change anything. Besides users and groups, it reads devices and routes, DNS, audit and network flow logs, webhooks, tailnet settings and contacts, and the list of every access token in the tailnet, plus any read API Tailscale adds later.</li>
  <li>`all:read` includes `users:read`, `policy_file:read`, `devices:posture_attributes:read` and `devices:core:read`. You do not need to select them.</li>
  <li>Add `users` (write) only to use the native actions that suspend, restore, approve, delete or change the role of users. Leave it out to keep the connection read-only. A Network admin cannot grant `users`, so an Owner, Admin or IT admin must create the client.</li>
</ul>

**4. Generate the credential**

Select **Generate credential**.

**5. Copy the client ID and the client secret**

On the **Credential created** page, copy the client ID and the client secret, store them securely for use later, then select **Done**.

<ul>
  <li>The client secret is shown once and cannot be copied again after you close the **Credential created** page.</li>
  <li>The client secret starts with `tskey-client-` and is case-sensitive.</li>
  <li>Paste the client ID into the **OAuth Client ID** field and the client secret into the **OAuth Client Secret** field in StackOne Hub.</li>
</ul>

## Know how long the client lasts

Tailscale OAuth clients do not expire. The client works until you revoke it.

<ul>
  <li>To stop StackOne from reading your tailnet, open the [Trust credentials](https://console.tailscale.com/admin/settings/trust-credentials) page, find the credential, and select **Revoke**. Select **Revoke** again to confirm.</li>
  <li>Revoking the credential also revokes the access tokens it created, and the connection stops working until you paste a new client ID and secret into StackOne Hub.</li>
</ul>

## Linking the Account from the Hub

**1. Navigate to the Hub**

Use one of the three [Linking Account Methods](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md) to access the Hub.

**2. Fill out the fields**

Fill out the following fields using details from your provider:

<ul>
  <li>**OAuth Client ID**</li>
  <li>**OAuth Client Secret**</li>
</ul>

**3. Connect**

<ul>
  <li>Click **Connect**</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup</li>
</ul>

If the account linking is successful, you will see the newly linked account on your [Accounts](https://app.stackone.com/accounts) page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.