Skip to main content
Open Connectors → Connect → Tailscale as an Administrator. The current form lets you choose OpenID Connect or OAuth client secret, then enter a label and Client ID. Both methods exchange for short-lived access tokens, but only the secret-based method stores your client secret.

​
Prefer federation when available

For OpenID Connect, configure the Tailscale client to trust the issuer and team subject shown by the Nuphos connection flow. Use that deployment’s values, not another team’s. Review the allowed scopes and tags before saving. If your backend does not offer federation, use a scoped OAuth client instead. For the secret-based method, create an OAuth client in the Tailscale admin console, grant only required scopes, and enter its Client ID and Client Secret in the secure Nuphos form. The secret is stored encrypted and exchanged for short-lived access tokens. Rotating it requires updating the connection.

​
Verify the connection

Select the binding in a conversation and ask the agent for a bounded device list. Check the expected tailnet and recent device state. A successful token exchange does not grant every Tailscale scope or permission to join nodes.

​
Reach private hosts

With explicit authorization and appropriate client scopes, tags and tailnet ACLs, the agent can join as a temporary node and SSH to an intended private host. Selecting the binding alone does not automatically join the tailnet or authorize a scan. SSH and network policy still apply. Confirm the node is removed when the task is done. For network questions, inspect device and ACL state first. A connectivity check must have an exact intended target; provider state alone is not proof of an end-to-end connection.

​
Manage access

Restrict the binding’s member access and select it only for conversations that need it. Permission modes govern runtime prompts; Tailscale scopes and ACLs enforce the provider boundary. Remove the Nuphos binding and revoke unneeded trust or client credentials at Tailscale when ending access.