tailscale up headless To authenticate visit login.tailscale.com authkey

Not specified by the original author.

tailscale up on a headless server: "To authenticate, visit: https://login.tailscale.com/a/..."

TL;DR: on a headless box tailscale up cant open a browser, so it prints a login URL and waits. Either open that URL on your phone or laptop and approve the device, or skip the dance entirely with tailscale up --authkey [your auth key] using a reusable auth key from the admin console.

To authenticate, visit: https://login.tailscale.com/a/[code]

Steps

1. Start the join:

sudo tailscale up

Expected output includes the login URL shown above.

2. Open that URL on any device with a browser, sign in, and approve the machine. The command returns on its own once you approve.
3. Verify:

tailscale status

Expected: your node listed with a 100.x.x.x address.

4. Unattended path (scripts, rebuilds, containers): in the Tailscale admin console generate a reusable auth key, then:

sudo tailscale up --authkey [your auth key]

Expected: the node joins immediately, no URL printed.

When this applies

• headless servers, VMs, and containers where tailscale up prints the URL and waits
• first-time joins with no browser on the box
• automated provisioning where nobody can click approve

When it doesnt

• failed to connect to local tailscaled — the daemon isnt running; start the service first
• invalid key on --authkey — the key was single-use and already consumed; generate a reusable one
• nodes showing Logged out later — check key expiry in the admin console

Compatibility

Tailscale 1.x, Linux, macOS, Windows.

Why it happens

The CLI delegates identity to the browser-based control-plane login. With no browser the out-of-band approval URL is the only channel, and auth keys exist precisely for the no-human case.

Edge cases

• keys expire: set a long expiry for servers or rotate on a schedule
• in Docker, pass the key as the TS_AUTHKEY env var instead of baking it into the image
• after tailscale up --reset you may need to re-approve the device

Find this skill again

curl -s 'https://vectle.com/api/v1/search?q=tailscale+up+headless+authenticate+visit'

Tailscale users setting up headless servers found sudo tailscale up prints To authenticate, visit: https://login.tailscale.com/a/... and then waits with no browser on the box. The verified fixes: approve the printed URL from any device with a browser, or for unattended setups use tailscale up --authkey with a reusable auth key from the admin console, then confirm with tailscale status. Source: https://github.com/tech-drew/home-lab-mini-rack/blob/HEAD/v1-lego-infrastructure-prototype/docs/networking/tailscale-setup.md

Not specified by the original author.

TL;DR

This error means the tailscaled daemon is stopped: the tailscale command you type is only a client, it talks to the daemon over a local socket, and every client command fails this way when the daemon is not running. On Linux, start the daemon with sudo systemctl enable --now tailscaled, then run sudo tailscale up again. It is not a network, account, or install problem; the background service is down or was never started.

failed to connect to local tailscaled; it doesn't appear to be running (sudo systemctl start tailscaled ?)

Use this when

• Any tailscale command (up, status, ping) fails with failed to connect to local tailscaled
• The message suggests starting tailscaled with systemctl and you are on Linux
• The same failure appears on macOS, Windows, or a snap install, where the daemon runs as an app, a service, or a snap instead

Not for this skill when

• tailscale status works but shows NeedsLogin. That is an expired session, not a stopped daemon; re-authenticate with tailscale up instead
• The daemon is running and active but nodes cannot reach each other. That is a connectivity or ACL problem, not this one

Steps

1. Start the daemon on Linux with systemd: sudo systemctl enable --now tailscaled. This starts it now and keeps it enabled across reboots.

Expected: no output, which means success.

2. Confirm it stayed up: systemctl is-active tailscaled.

Expected: active. Anything else means the daemon started and died; go to step 4.

3. Retry the client: sudo tailscale status, then sudo tailscale up if it asks you to log in.

Expected: your node info prints instead of the connect error, and the node comes online.

4. If the service will not stay up, read the log: journalctl -u tailscaled -n 50. The common causes are a missing /dev/net/tun device (containers and LXC guests need the TUN device passed through from the host) or another VPN holding the device.

Expected: the log names the cause instead of the generic client-side connect error.

5. On other platforms, start the equivalent service. macOS: relaunch the Tailscale app; the daemon is a system extension, so approve it under System Settings, Privacy and Security if it is blocked. Windows: start the Tailscale service in services.msc. Snap installs: sudo snap restart tailscale.

Expected: the client commands in step 3 succeed on that platform too.

Variant phrasings

tailscaled doesn't appear to be running

The same stopped-daemon failure without the systemctl hint in the text. Start the daemon for your platform (steps 1 and 5), then retry.

tailscale up failed to connect to local tailscaled

tailscale up is a client command, so it fails like all the others while the daemon is down. The fix order matters: daemon first, up second.

tailscale daemon not running ubuntu

On Ubuntu the daemon is the tailscaled systemd unit (step 1), or the tailscale snap on snap installs (step 5). Check is-active before reinstalling anything; a reinstall does not fix a service that was simply never started.

Root cause

Client/daemon split. The socket the CLI dials only exists while tailscaled runs, so a stopped daemon breaks every client command the same way, and the error text points at the daemon because that is the missing piece.

Edge cases

• On headless servers, authenticate with an auth key when you run tailscale up, since there is no browser to complete the login.
• Do not run tailscale up under a short timeout: it blocks waiting for the browser login, and a timeout kill looks like a new failure.
• In containers and LXC guests, no service restart fixes a missing TUN device; the host has to pass /dev/net/tun through.

Tool compatibility

Tailscale on Linux (systemd and snap installs), macOS (app with system extension), and Windows (Tailscale service). Applies whenever the tailscaled daemon is installed but not running.

Related skills

• duplicate node key tailscale: fix the Duplicate node key warning in the admin console: https://vectle.com/skills/skl_qmlicXbtFhGlMME7wMix7w
• tailscale up on a headless server: https://vectle.com/skills/skl_RqENuhopBsY-tKOM-lFSmQ

Provenance

Built from the Tailscale install docs: https://tailscale.com/kb/1032/install-ubuntu

Source: The tailscale command you type is only a client. It talks to the tailscaled daemon over a local socket, and every client command fails with this message when the daemon is not running. This is not a network, account, or install problem. It means the background service is down or was never started.

Verified resolution: Short answer: start the daemon. On Linux: sudo systemctl enable --now tailscaled. Then run sudo tailscale up again. `` failed to connect to local tailscaled; it doesn't appear to be running (sudo systemctl start tailscaled ?) 1. Run sudo systemctl enable --now tailscaled. This starts the daemon now and keeps it enabled across reboots. Expected: no output means success. 2. Confirm with systemctl is-active tailscaled. Expected: active. 3. Retry sudo tailscale status. Expected: your node's info, not the connect error. 4. If the service will not stay up, read journalctl -u tailscaled -n 50. Common causes: a missing /dev/net/tun device (containers and LXC guests need the TUN device passed through from the host) or another VPN holding the device. 5. Other platforms: on macOS relaunch the Tailscale app (the daemon is a system extension, approve it under System Settings, Privacy and Security if blocked). On Windows start the Tailscale service in services.msc. Snap installs: sudo snap restart tailscale. Root cause: client/daemon split. The socket the CLI dials only exists while tailscaled runs, so a stopped daemon breaks every client command the same way. When to use: this exact message on any OS. When NOT to use: if tailscale status works but shows NeedsLogin, that is an expired session, re-authenticate with tailscale up instead. Variant phrasings: "tailscaled doesn't appear to be running", "tailscale up failed to connect to local tailscaled", "tailscale daemon not running ubuntu". Edge cases: on headless servers pass an auth key (tailscale up with your auth key) since there is no browser. Do not run tailscale up` under a short timeout, it blocks waiting for the browser login and a timeout kill looks like a new failure.

Source URL: https://tailscale.com/kb/1032/install-ubuntu

Not specified by the original author.

backend error: authkey expired

TL;DR: the pre-auth key baked into your pipeline has expired. Mint a new key on the admin console keys page, mark it reusable and disable expiry if the fleet is long-lived, then swap it into your CI secret. Expired keys cannot be revived.

backend error: authkey expired

Steps

1. Open the admin console and go to the keys page.
2. Generate a new auth key. Tick reusable, and for long-lived CI fleets disable key expiry.

Expected: the console shows the new key value once. Copy it now.

3. Replace the old key in your CI secrets or env config with the new value.
4. Re-run the join:

tailscale up --authkey [your new key]

Expected: the node appears in the admin console machines list, no backend error.

When this applies

• CI runners or cloud-init scripts that join the tailnet with a stored key
• the same key worked last month and fails now with no config change
• keys with the default 90-day expiry on long-lived automation

When it doesnt

• authkey already used — that is a one-time key spent twice, a different fix
• invalid key: API key does not exist — the key was deleted, not expired
• interactive tailscale up asking for a browser login — no key involved

Compatibility

tailscale CLI anywhere tailscale up --authkey is used: CI runners, cloud-init, Docker entrypoints.

Other phrasings

• tailscale up fails: authkey expired
• pre-auth key expired

Why it happens

Auth keys carry an expiry timestamp. When it passes, the control plane rejects the key at join time. Automation that worked for months breaks overnight with no other change, which is why this one is confusing the first time.

Edge cases

• Disabling expiry is convenient but widens the blast radius if the key leaks; prefer short-lived keys injected per-run where you can.
• If nodes join but immediately disappear, check whether an old expired key is still cached in a second config path.

A CI pipeline joining the tailnet with a stored pre-auth key started failing with backend error: authkey expired after months of working. The verified fix was generating a fresh key with expiry disabled and rotating it into CI secrets. Source: https://github.com/senseuwaterloo/homepage/issues/7 (gh:senseuwaterloo/homepage#7).