tsidp - Tailscale OpenID Connect (OIDC) Identity Provider

[!CAUTION] This is an experimental update of tsidp. It is under active development and may experience breaking changes.

tsidp is an OIDC / OAuth Identity Provider (IdP) server that integrates with your Tailscale network. It allows you to use Tailscale identities for authentication into applications that support OpenID Connect as well as authenticated MCP client / server connections.

Prerequisites

• A Tailscale network (tailnet) with MagicDNS and HTTPS enabled
• A Tailscale authentication key from your tailnet
• (Recommended) Docker installed on your system
• Ability to set an Application capability grant

Running tsidp

(Recommended) Using the pre-built image

Docker images are automatically published at https://ghcr.io/tailscale/tsidp when releases are tagged.

[!TIP] Replace YOUR_TAILSCALE_AUTHKEY with your Tailscale authentication key in the following commands:

Use an existing auth key or create a new auth key in the Keys page of the Tailscale admin console. Ensure you select an existing tag or create a new one.

Here is an example docker compose YAML file for tsidp:

services:
  tsidp:
    container_name: tsidp
    image: ghcr.io/tailscale/tsidp:latest
    volumes:
      - tsidp-data:/data
    environment:
      - TAILSCALE_USE_WIP_CODE=1 # tsidp is experimental - needed while version <1.0.0
      - TS_STATE_DIR=/data # store persistent tsnet and tsidp state
      - TS_HOSTNAME=idp # Hostname on tailnet (becomes idp.your-tailnet.ts.net)
      - TSIDP_ENABLE_STS=1 # Enable OAuth token exchange
      # Optional: Tailscale auth key for automatic node registration
      # - TS_AUTHKEY=tskey-auth-xxxxx
volumes:
  tsidp-data:

Paste the YAML snippet above into a file named compose.yaml. Once the compose file has been edited to your satisfaction, start tsidp by issuing docker compose up -d. Monitor the result with docker compose logs -f.

Once tsidp has started, visit https://idp.yourtailnet.ts.net in a browser to confirm the service is running.

[!NOTE] If you're running tsidp for the first time it may take a few minutes for the TLS certificate to generate. You may not be able to access the service until the certificate is ready.

[!NOTE] Using OAuth Client Secrets

As an alternative to traditional auth keys, you can use OAuth client secrets for automatic node registration.

Setup:

1. In the Tailscale admin console, create an OAuth client with Auth Keys → Write scope
2. Ensure the advertise tag (e.g. tag:tsidp) is defined in your ACL tagOwners
3. Set TS_AUTHKEY to your OAuth client secret (tskey-client-...)
4. Set TS_ADVERTISE_TAGS (or --advertise-tags) — required when using OAuth client secrets

environment:
  - TS_AUTHKEY=tskey-client-xxxxx
  - TS_ADVERTISE_TAGS=tag:tsidp