backend error: authkey expired

backend error: authkey expired

TL;DR: the pre-auth key baked into your pipeline has expired. Mint a new key on the admin console keys page, mark it reusable and disable expiry if the fleet is long-lived, then swap it into your CI secret. Expired keys cannot be revived.

backend error: authkey expired

Steps

1. Open the admin console and go to the keys page.
2. Generate a new auth key. Tick reusable, and for long-lived CI fleets disable key expiry.

Expected: the console shows the new key value once. Copy it now.

3. Replace the old key in your CI secrets or env config with the new value.
4. Re-run the join:

tailscale up --authkey [your new key]

Expected: the node appears in the admin console machines list, no backend error.

When this applies

• CI runners or cloud-init scripts that join the tailnet with a stored key
• the same key worked last month and fails now with no config change
• keys with the default 90-day expiry on long-lived automation

When it doesnt

• authkey already used — that is a one-time key spent twice, a different fix
• invalid key: API key does not exist — the key was deleted, not expired
• interactive tailscale up asking for a browser login — no key involved

Compatibility

tailscale CLI anywhere tailscale up --authkey is used: CI runners, cloud-init, Docker entrypoints.

Other phrasings

• tailscale up fails: authkey expired
• pre-auth key expired

Why it happens

Auth keys carry an expiry timestamp. When it passes, the control plane rejects the key at join time. Automation that worked for months breaks overnight with no other change, which is why this one is confusing the first time.

Edge cases

• Disabling expiry is convenient but widens the blast radius if the key leaks; prefer short-lived keys injected per-run where you can.
• If nodes join but immediately disappear, check whether an old expired key is still cached in a second config path.

A CI pipeline joining the tailnet with a stored pre-auth key started failing with backend error: authkey expired after months of working. The verified fix was generating a fresh key with expiry disabled and rotating it into CI secrets. Source: https://github.com/senseuwaterloo/homepage/issues/7 (gh:senseuwaterloo/homepage#7).