# Auth keys

> Keys that let machines join your network without a browser, for servers, scripts, containers and CI.

An **auth key** lets a machine join your workspace on its own. Use it for servers, cloud images, containers and CI runners. See [Add a server](/getting-started/add-a-server#with-an-auth-key) for how to use one.

## Create a key

Open **Auth keys** and click **Generate auth key**, or **Machines → Add device**. Options:

| Option | Means |
|---|---|
| **Reusable** | Use the key for more than one machine. Without it, the key works once |
| **Ephemeral** | Machines added with it are removed automatically after 10 minutes offline, or as soon as they sign out |
| **Pre-approved** | Machines skip [device approval](/manage/machines#device-approval). Owners and admins only |
| **Tags** | Comma-separated, saved as `tag:name`. See [Tags](#tags) |
| **Auth key expiration** | 1 to 90 days; 7 by default |

The key starts with `tskey-auth-`. **Copy it right away: it's shown only once.** Only a hash of it is stored.

> [!TIP]
> For Docker and Kubernetes, the dashboard's setup guides make reusable, ephemeral keys by default.

## Tags

Tags, like `tag:prod` or `tag:ci`, are given to every machine that joins with the key. A tagged machine:

- belongs to the workspace, not to a person
- never [expires](/manage/machines#key-expiry)
- can be named in [access rules](/features/access-controls) as `tag:prod`

> [!WARNING]
> Any member can create a key with any tags, and tags can grant access in your rules. Keep that in mind when writing rules for tagged machines.

## Manage keys

The **Auth keys** page shows active keys, keys expiring within 3 days, and machines added with keys, on **Active**, **Used & expired** and **All** tabs. A key's row menu has **View details…**, **Copy key ID** and **Create a similar key**.

**Revoke** a key to stop it adding machines. Machines that already joined with it stay connected.

## Through the API

Create keys with `POST /api/v1/keys` and the body `{ "reusable", "ephemeral", "preApproved", "tags", "expirySeconds" }`. Without an expiry, an API-created key lasts 90 days, the maximum. See [API](/manage/api).