duplicate node key tailscale: fix the Duplicate node key warning in the admin console

TL;DR

A duplicate node key tailscale warning means two devices are checking in with the same node key, almost always because a VM, disk image, or phone backup was cloned and copied the key with it. Delete the stale duplicate in the admin console machines list, then run tailscale logout and tailscale up on the real device so it mints a fresh key, and the warning clears within a minute or two.

Duplicate node key

Shown as a warning banner on a device in the Tailscale admin console machines page. Sometimes it flickers on refresh; that still counts.

Use this when

• The admin console shows Duplicate node key on one or more machines
• You cloned a VM, duplicated a disk image, or restored a backup onto new hardware
• You migrated a NAS or server and the old entry still exists
• An Android device keeps re-registering the same key after an update or reinstall

Not for this skill when

• tailscale up fails with an auth error but there is no duplicate warning (that is an expired or wrong auth key, a different fix)
• A device cannot connect at all and the daemon is not running (check the tailscaled service first, see related skills)
• The warning names a device you do not recognise at all (treat it as a possible unauthorised device before deleting anything)

Steps

1. Find the two machines sharing the key. Open the admin console machines page and look for the device carrying the warning. If you cloned a VM or restored from an image, the original and the clone usually show the same hostname.

Expected: you can tell the live machine (recent last seen time) from the stale entry.

2. Delete the stale duplicate. On the stale entry, open the machine menu (three dots) and choose Remove. Do not remove the live one.

Expected: the stale entry disappears from the list.

3. Re-authenticate the live device for a fresh key. On the real device, run:

tailscale logout
tailscale up

Complete the browser login when prompted.

Expected: tailscale status shows the machine connected with no warnings. Logging out and back in mints a brand new node key, so even a lingering duplicate reference cannot collide with it.

4. Confirm the warning is gone. Refresh the admin console.

Expected: no Duplicate node key banner on any device. If it flickers once and vanishes, you are done.

Variant phrasings

Duplicate Node key with capital N

Same warning, older console wording. Same fix: remove the stale machine, re-authenticate the real one.

duplicate node key tailscale on Android after an update

Reported on Android after the Taildrop release (1.84.x): uninstall and reinstall alone did not clear it, because the restored state carried the same key. Update the Android app first, then follow the console steps above; see the Android-specific related skill below.

Warning only flickers on page refresh

Reporters saw the banner flash for a split second on refresh. It usually means the duplicate entry was already removed but the page cached the state. Hard-refresh and re-check; if it stays gone, you are done.

The clone keeps coming back after deletion

The cloned machine is still online and still checking in with the shared key. Find it and re-authenticate it (step 3 on that machine); deleting its console entry alone will not stick.

Why it happens

Every Tailscale device has a node key that identifies it to the coordination server. Cloning a disk, a VM snapshot, or a phone backup copies the stored tailscaled state, key included, so two machines check in as the same identity. The console cannot tell which one is real, so it flags the duplicate node key on the device.

Edge cases

• Fleets from one golden image: bake a logout into your image build, or better, provision each machine with its own one-use auth key at first boot so no two machines ever share a key.
• Deactivate and reactivate workaround: some users cleared the warning by deactivating the device in the console and reactivating it. Works when the duplicate is transient, not when a real clone is still checking in.
• Synology and NAS migrations: the migrated unit can loop on the warning until its stored state is cleared and it re-authenticates; the console deletion plus step 3 pattern is the same.

Tool compatibility

Tailscale client 1.80 and newer, all platforms. Admin console steps are the same everywhere. The Android Taildrop variant was reported on 1.84.1.

Related skills

• Android: Showing duplicate node key after recent update: https://vectle.com/skills/sklBSAw2RUixtuGO-vDLWh7A
• failed to connect to local tailscaled: https://vectle.com/skills/sklNPwV_5cl6yMBle9m-Vebg
• failed to connect to local tailscaled; it doesn't appear to be running (sudo systemctl start tailscaled ?): https://vectle.com/skills/skl4YwQAf3Qw4x1i7hxkNzLA

Provenance

Resolved from tailscale/tailscale issue 16366 and the duplicate-key reports linked from it (cloned state files, Synology migration loop).