> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Tailscale

> Connect a tailnet to access devices and network state.

Nuphos authenticates to your tailnet with an **OAuth client**, minting short-lived
access tokens on demand so the agent can see your devices and network state.

## Connect

### Create an OAuth client

In the Tailscale admin console, under **Settings → OAuth clients**, create a new
OAuth client. Tailscale shows the **client ID** and **client secret** once — copy
both.

### Connect in Nuphos

In **Connectors → Connect → Tailscale**, enter:

| Field                   | Notes                                      |
| ----------------------- | ------------------------------------------ |
| **Label**               | A friendly name, e.g. "Production tailnet" |
| **OAuth Client ID**     | From Tailscale                             |
| **OAuth Client Secret** | From Tailscale (stored encrypted)          |

Nuphos verifies the credentials against Tailscale's OAuth endpoint before saving.

## In the Nuphos app

Tailscale work happens **through the agent** — there's no dedicated browsing
surface for tailnet resources. The binding itself lives in **Connectors**, where
an Administrator can manage its allow-list or remove it.

## What the agent can do for you

The agent can list devices in the tailnet and inspect network state, minting
short-lived tokens as needed. That makes it useful for questions like:

* *"Which devices in the tailnet haven't checked in this week?"*
* *"Is the database server reachable from the CI runner over Tailscale?"* — the
  agent combines tailnet state with what it knows from your
  [connected cloud accounts](/connectors/overview) to trace connectivity.

## Permissions & authorization

Two boundaries govern what happens through this connector:

* **Hard boundary — who can use it.** Only team **Administrators** can bind or
  remove the OAuth client, and they can restrict it to specific members with a
  [member allow-list](/security/access-control). Within a session the agent only
  holds credentials you explicitly selected, re-checked on every request.
* **Soft boundary — what the agent may do with it.** Reads run freely; anything
  that would change tailnet state goes through
  [plan approvals](/security/approvals) and
  [Auto-authorization](/security/auto-mode).

The outer limit is the OAuth client's **scopes** — when you create it in
Tailscale, grant only the scopes you want the agent to have (read-only scopes
are a good starting point), and Tailscale enforces the rest.

## Good to know

* Access tokens are minted **on demand and short-lived** — Nuphos stores the
  client credentials encrypted, never a long-lived tailnet token.
* Rotating the client secret in Tailscale invalidates the binding — update it in
  Nuphos afterwards.