# Glossary

> The words used across the product and these docs.

**Workspace.** One private network, with its own devices, people and settings. Everyone has a personal workspace and can be invited to others. In some technical places it's called a *tailnet*.

**Machine.** A device in your network: a laptop, server, cloud VM or Raspberry Pi. The dashboard and CLI say *machine*; the website sometimes says *device*.

**Owner, admin, member.** The three [roles](/manage/people#roles) a person can have in a workspace.

**Tag.** A label like `tag:prod` given to machines through the [auth key](/manage/auth-keys) they join with. Tagged machines belong to the workspace rather than a person, never expire, and can be named in [access rules](/features/access-controls).

**Auth key.** A key (`tskey-auth-…`) that lets a machine join without a browser. See [Auth keys](/manage/auth-keys).

**API token.** A token (`tsapi-…`) for automating your workspace through the [API](/manage/api).

**Ephemeral machine.** A machine joined with an ephemeral auth key. It's removed after 10 minutes offline, or as soon as it signs out. Good for CI runners and short-lived containers.

**Device approval.** A workspace setting where new machines wait for an admin before they can reach anything.

**Key expiry.** How long a machine stays signed in before it has to sign in again: 180 days by default.

**MagicDNS, easy names.** Names for your machines and services, like `db-prod`, answered on each device. See [Easy names](/features/easy-names).

**Service.** An internal app with its own name and address, served by one or more machines, with failover. Written `svc:<name>`. See [Services](/features/services).

**Subnet router.** A machine that lets the rest of your network reach a whole network it's on, like an office LAN. See [Subnet routes](/features/subnet-routes).

**Exit node.** A machine other devices can send their internet traffic through. See [Exit nodes](/features/exit-nodes).

**App connector.** A machine that sends traffic for chosen internet domains out from its own public address, so allow-lists need one address. See [App connectors](/features/app-connectors).

**Relay.** The fallback that carries encrypted traffic between two devices when they can't connect directly. See [How it works](/concepts/how-it-works#the-relay).

**Direct connection.** Two devices talking straight to each other, without the relay.

**Access controls, policy.** The rules for which people and devices can reach each other. See [Access controls](/features/access-controls).

**Coordination service.** The service your devices check in with to learn about each other. It never carries your traffic.