Skip to main content
Nuphos authenticates to your tailnet with an OAuth client, minting short-lived access tokens on demand so the agent can see your devices and network state.

Connect

Create an OAuth client

In the Tailscale admin console, under Settings → OAuth clients, create a new OAuth client. Tailscale shows the client ID and client secret once — copy both.

Connect in Nuphos

In Connectors → Connect → Tailscale, enter: Nuphos verifies the credentials against Tailscale’s OAuth endpoint before saving.

In the Nuphos app

Tailscale work happens through the agent — there’s no dedicated browsing surface for tailnet resources. The binding itself lives in Connectors, where an Administrator can manage its allow-list or remove it.

What the agent can do for you

The agent can list devices in the tailnet and inspect network state, minting short-lived tokens as needed. That makes it useful for questions like:
  • “Which devices in the tailnet haven’t checked in this week?”
  • “Is the database server reachable from the CI runner over Tailscale?” — the agent combines tailnet state with what it knows from your connected cloud accounts to trace connectivity.

Permissions & authorization

Two boundaries govern what happens through this connector:
  • Hard boundary — who can use it. Only team Administrators can bind or remove the OAuth client, and they can restrict it to specific members with a member allow-list. Within a session the agent only holds credentials you explicitly selected, re-checked on every request.
  • Soft boundary — what the agent may do with it. Reads run freely; anything that would change tailnet state goes through plan approvals and Auto-authorization.
The outer limit is the OAuth client’s scopes — when you create it in Tailscale, grant only the scopes you want the agent to have (read-only scopes are a good starting point), and Tailscale enforces the rest.

Good to know

  • Access tokens are minted on demand and short-lived — Nuphos stores the client credentials encrypted, never a long-lived tailnet token.
  • Rotating the client secret in Tailscale invalidates the binding — update it in Nuphos afterwards.