Manage
Auth keys
Keys that let machines join your network without a browser, for servers, scripts, containers and CI.
An auth key lets a machine join your workspace on its own. Use it for servers, cloud images, containers and CI runners. See Add a server for how to use one.
Create a key
Open Auth keys and click Generate auth key, or Machines → Add device. Options:
| Option | Means |
|---|---|
| Reusable | Use the key for more than one machine. Without it, the key works once |
| Ephemeral | Machines added with it are removed automatically after 10 minutes offline, or as soon as they sign out |
| Pre-approved | Machines skip device approval. Owners and admins only |
| Tags | Comma-separated, saved as tag:name. See Tags |
| Auth key expiration | 1 to 90 days; 7 by default |
The key starts with tskey-auth-. Copy it right away: it's shown only once. Only a hash of it is stored.
Tip
For Docker and Kubernetes, the dashboard's setup guides make reusable, ephemeral keys by default.
Tags
Tags, like tag:prod or tag:ci, are given to every machine that joins with the key. A tagged machine:
- belongs to the workspace, not to a person
- never expires
- can be named in access rules as
tag:prod
Warning
Any member can create a key with any tags, and tags can grant access in your rules. Keep that in mind when writing rules for tagged machines.
Manage keys
The Auth keys page shows active keys, keys expiring within 3 days, and machines added with keys, on Active, Used & expired and All tabs. A key's row menu has View details…, Copy key ID and Create a similar key.
Revoke a key to stop it adding machines. Machines that already joined with it stay connected.
Through the API
Create keys with POST /api/v1/keys and the body { "reusable", "ephemeral", "preApproved", "tags", "expirySeconds" }. Without an expiry, an API-created key lasts 90 days, the maximum. See API.