Skip to main content
Nuphos authenticates to your tailnet with an OAuth client, minting short-lived access tokens on demand so the agent can see your devices and network state.

​
Connect

​
Create an OAuth client

In the Tailscale admin console, under Settings → OAuth clients, create a new OAuth client. Tailscale shows the client ID and client secret once — copy both.

​
Connect in Nuphos

In Connectors → Connect → Tailscale, enter: Nuphos verifies the credentials against Tailscale’s OAuth endpoint before saving.

​
In the Nuphos app

The bound tailnet gets a Devices page listing its nodes. Everything else — ACLs, keys, DNS — is done through the agent. The binding itself lives in Connectors, where an Administrator can manage its allow-list or remove it.

​
Reaching private hosts from a session

A tailnet is also how the agent reaches machines that have no public address. When you grant it for a session, the agent’s sandbox joins your tailnet as an ephemeral node for the length of that session, so it can SSH to a private host the same way you would. The node is created on demand and removed afterwards; it is subject to your tailnet ACLs like any other device, so scope those to what you want reachable.

​
What the agent can do for you

The agent can list devices in the tailnet and inspect network state, minting short-lived tokens as needed. That makes it useful for questions like:
  • “Which devices in the tailnet haven’t checked in this week?”
  • “Is the database server reachable from the CI runner over Tailscale?” — the agent combines tailnet state with what it knows from your connected cloud accounts to trace connectivity.

​
Permissions & authorization

Two boundaries govern what happens through this connector:
  • Hard boundary — who can use it. Only team Administrators can bind or remove the OAuth client, and they can restrict it to specific members with a member allow-list. Within a session the agent only holds credentials you explicitly selected, re-checked on every request.
  • Soft boundary — what the agent may do with it. Reads run freely; anything that would change tailnet state goes through plan approvals and Auto-authorization.
The outer limit is the OAuth client’s scopes — when you create it in Tailscale, grant only the scopes you want the agent to have (read-only scopes are a good starting point), and Tailscale enforces the rest.

​
Good to know

  • Access tokens are minted on demand and short-lived — Nuphos stores the client credentials encrypted, never a long-lived tailnet token.
  • Rotating the client secret in Tailscale invalidates the binding — update it in Nuphos afterwards.