tailscale logout node key - what logout expires and how to fully remove or re-register a node

TL;DR

tailscale logout brings the node down and expires its node key, so the next tailscale up needs a fresh login and gets a renewed node key. It does not, by itself, delete a normal (non-ephemeral) device from the tailnet or erase the local machine identity stored in the tailscaled state. If the goal is a clean removal or reclaiming the plain hostname, also delete the device record in the admin console or via the API, and only wipe the local state when a brand new machine identity is wanted.

tailscale logout node key

The search phrasing people use when logout did less, or more, than they expected: the device is still listed, the hostname is still taken, or re-login came back with a suffixed name like NAME-1.

Use this when

• You ran tailscale logout and the device still appears in the admin console machines list
• You want to know whether logout renews, expires, or deletes the node key
• A replacement machine registers as NAME-1 because the old record still holds the hostname
• You are decommissioning a machine and want it gone, not just logged out
• You are rebuilding a VM or container and want a fresh registration instead of the old identity

Not for this skill when

• The admin console shows a Duplicate node key warning on a live device (that is two machines sharing one key; use the duplicate node key skill linked below)
• tailscaled is not running at all and tailscale status cannot reach the daemon
• tailscale up fails on an expired or already used auth key before any logout is involved
• You only want to disconnect temporarily; use tailscale down, which keeps the login and the node key valid

Steps

1. Check the current node key expiry before you change anything. Run:

tailscale status --json

Look at the Self section for the hostname and the KeyExpiry value.

Expected: a future expiry date while logged in. Note the hostname exactly; you will compare it after re-registering.

2. Log out. Run:

tailscale logout
tailscale status

Expected: the node disconnects and status reports it as logged out or needing login. On the coordination server the node key is now expired, so the old session cannot simply resume.

3. Decide which of the three outcomes you actually want, because logout alone only does the first one:

• Renew the key and rejoin as the same device: go to step 4.
• Remove the device from the tailnet entirely: go to step 5.
• Start over with a fresh machine identity and the clean hostname: go to steps 5 and 6.

Expected: you do not delete the console record or wipe state for a plain re-login; both are extra, deliberate steps.

4. Re-register with a renewed node key (same device). Run:

tailscale up
tailscale status --json

Complete the browser login, or pass a fresh auth key in the way your deployment normally does.

Expected: the device rejoins, usually with the same hostname, address, and console entry, and KeyExpiry shows a new future date. Logging back in renews the node key; it does not create a second device, because the local machine identity was kept.

5. Fully remove the device record (frees the hostname). In the admin console machines page, open the logged-out device menu and choose Remove or Delete. An admin can also delete it through the Tailscale API device delete endpoint, using the device id from the devices list.

Expected: the device disappears from the machines list. This deletion is done on the coordination server, not from the device CLI; there is no logout flag that does it. Do this before the replacement logs in if the replacement must claim the plain hostname instead of NAME-1.

6. Optional, only for a fresh machine identity: wipe the local state. Stop tailscaled, then remove or move aside its state file (on Linux that is tailscaled.state under /var/lib/tailscale; in containers, the state volume or directory you mounted for /var/lib/tailscale), then start tailscaled and run tailscale up again.

Expected: the machine registers as a new device. Skip this step for a normal re-login: deleting state when you only meant to log out is what creates stray duplicate entries and suffixed names.

7. Verify the end state. Run tailscale status and refresh the admin console.

Expected: exactly one entry for the machine, with the expected hostname (no -1 suffix), a connected state if you rejoined, and a future KeyExpiry.

Variant phrasings

tailscale logout does not remove the device

Correct for non-ephemeral nodes. The record stays on the coordination server until an admin deletes it or, for ephemeral nodes, until the ephemeral cleanup removes it. Ephemeral nodes are the exception: they are removed on logout, or shortly after going offline.

tailscale logout vs tailscale down

down only disconnects; the login and node key stay valid, so up reconnects with no login. logout expires the node key, so the next up must authenticate again.

re-login after logout gives NAME-1

The old record still holds the plain hostname. Delete the old device in the console (step 5), then log the new machine in. If the new machine already joined as NAME-1, log it out, delete both stale records if needed, clear its local state (step 6), and rejoin.

how do I get a new node key in tailscale

Logout followed by tailscale up (steps 2 and 4). The re-login mints the renewed node key; there is no separate rotate command for the node key.

Why it happens

Three different things get conflated as the node key. The node key is the per-login device credential: it expires on logout and otherwise after a set period, which forces re-authentication. The machine key is the longer-lived device identity kept in the local tailscaled state; logout leaves it in place, which is why re-login lands on the same console entry. The device record lives on the coordination server, which is the source of truth for tailnet membership, so only a console or API deletion (or ephemeral cleanup) removes it and frees the hostname.

Edge cases

• Tagged and server devices: key expiry is often disabled for tagged nodes, but logout still expires the session; re-login with a fresh, unused auth key, and do not reuse a single-use key that a failed attempt may have consumed.
• Automation and destroy flows: running logout at teardown helps only if it actually runs while the machine is reachable and online. An unreachable machine cannot log itself out, so pair it with a console or API cleanup for the stale record.
• Golden images and clones: an image that ships a populated tailscaled state ships the machine identity too, so clones collide. Bake images with an empty state and provision a per-machine auth key at first boot.
• Tailnet Lock and device approval: a fresh identity from step 6 can need approval or signing again, even when the old entry was already approved.

Tool compatibility

Tailscale CLI 1.80 and newer on Linux, macOS, and Windows, plus the official container image. Console and API device deletion need tailnet admin access. State file location differs on macOS and Windows app installs; the wipe step is mainly a Linux and container pattern.

Related skills

• duplicate node key tailscale: https://vectle.com/skills/skl_qmlicXbtFhGlMME7wMix7w
• failed to connect to local tailscaled: https://vectle.com/skills/skl4YwQAf3Qw4x1i7hxkNzLA