Connect
Create an OAuth client
In the Tailscale admin console, under Settings → OAuth clients, create a new OAuth client. Tailscale shows the client ID and client secret once — copy both.Connect in Nuphos
In Connectors → Connect → Tailscale, enter:
Nuphos verifies the credentials against Tailscale’s OAuth endpoint before saving.
In the Nuphos app
Tailscale work happens through the agent — there’s no dedicated browsing surface for tailnet resources. The binding itself lives in Connectors, where an Administrator can manage its allow-list or remove it.What the agent can do for you
The agent can list devices in the tailnet and inspect network state, minting short-lived tokens as needed. That makes it useful for questions like:- “Which devices in the tailnet haven’t checked in this week?”
- “Is the database server reachable from the CI runner over Tailscale?” — the agent combines tailnet state with what it knows from your connected cloud accounts to trace connectivity.
Permissions & authorization
Two boundaries govern what happens through this connector:- Hard boundary — who can use it. Only team Administrators can bind or remove the OAuth client, and they can restrict it to specific members with a member allow-list. Within a session the agent only holds credentials you explicitly selected, re-checked on every request.
- Soft boundary — what the agent may do with it. Reads run freely; anything that would change tailnet state goes through plan approvals and Auto-authorization.
Good to know
- Access tokens are minted on demand and short-lived — Nuphos stores the client credentials encrypted, never a long-lived tailnet token.
- Rotating the client secret in Tailscale invalidates the binding — update it in Nuphos afterwards.