Glossary

Workspace. One private network, with its own devices, people and settings. Everyone has a personal workspace and can be invited to others. In some technical places it's called a tailnet.

Machine. A device in your network: a laptop, server, cloud VM or Raspberry Pi. The dashboard and CLI say machine; the website sometimes says device.

Owner, admin, member. The three roles a person can have in a workspace.

Tag. A label like tag:prod given to machines through the auth key they join with. Tagged machines belong to the workspace rather than a person, never expire, and can be named in access rules.

Auth key. A key (tskey-auth-…) that lets a machine join without a browser. See Auth keys.

API token. A token (tsapi-…) for automating your workspace through the API.

Ephemeral machine. A machine joined with an ephemeral auth key. It's removed after 10 minutes offline, or as soon as it signs out. Good for CI runners and short-lived containers.

Device approval. A workspace setting where new machines wait for an admin before they can reach anything.

Key expiry. How long a machine stays signed in before it has to sign in again: 180 days by default.

MagicDNS, easy names. Names for your machines and services, like db-prod, answered on each device. See Easy names.

Service. An internal app with its own name and address, served by one or more machines, with failover. Written svc:<name>. See Services.

Subnet router. A machine that lets the rest of your network reach a whole network it's on, like an office LAN. See Subnet routes.

Exit node. A machine other devices can send their internet traffic through. See Exit nodes.

App connector. A machine that sends traffic for chosen internet domains out from its own public address, so allow-lists need one address. See App connectors.

Relay. The fallback that carries encrypted traffic between two devices when they can't connect directly. See How it works.

Direct connection. Two devices talking straight to each other, without the relay.

Access controls, policy. The rules for which people and devices can reach each other. See Access controls.

Coordination service. The service your devices check in with to learn about each other. It never carries your traffic.