Tailscale Key Management

Workflow skill for managing Tailscale auth keys including creation, listing, rotation, revocation, and expiry tracking.

Workflow 1: List Keys

1. Call tailscale_key_list to retrieve all auth keys.
2. Format as a table:

1. Flag expired keys with ❌ and keys expiring within 7 days with ⚠️.
2. Show total count and breakdown by status.

Workflow 2: Key Details

1. Call tailscale_key_get with the key ID.
2. Display:

• Description, creation date, expiry date
• Capabilities: reusable, ephemeral, preauthorized
• Tags assigned to devices created with this key
• Usage count (if available)
• Revocation status

Workflow 3: Create Key

1. Gather options from the user:

• Reusable: can the key be used multiple times? (default: false)
• Ephemeral: do devices created with this key auto-expire? (default: false)
• Preauthorized: skip manual device authorization? (default: false)
• Tags: ACL tags for devices (e.g., tag:server, tag:ci)
• Expiry: seconds until key expires (default: 90 days = 7776000)
• Description: human-readable name for the key

1. Call tailscale_key_create with the gathered options.
2. ⚠️ IMPORTANT: Display the key value prominently — it is shown ONLY ONCE and cannot be retrieved later.
3. Warn the user to save the key securely immediately.
4. Show the install command: tailscale up --authkey=<key>

Workflow 4: Revoke Key

1. Call tailscale_key_list to show all keys.
2. User selects which key to revoke.
3. Show key details for confirmation.
4. Require explicit user confirmation — revoked keys cannot be un-revoked.
5. Call tailscale_key_delete with confirm=true.
6. Verify: tailscale_key_list to confirm revocation.

Workflow 5: Key Rotation Audit

1. Call tailscale_key_list.
2. Identify:

• Expired keys still in the list
• Keys expiring within 7 days
• Long-lived reusable keys (security concern)

1. Recommend rotation for expiring keys.
2. Suggest creating replacement keys before revoking old ones.

Rules

• Key value is shown only once at creation — always warn the user to save it immediately.
• Expired keys should be highlighted prominently in any listing.
• Keys expiring within 7 days are flagged as WARNING.
• Reusable + non-ephemeral keys are higher security risk — note this when creating.
• Destructive actions (revoke) require explicit user confirmation.
• Always verify after mutations using a read operation.

Key Tools

• tailscale_key_list — list all auth keys with status
• tailscale_key_get — get key details
• tailscale_key_create — create a new auth key
• tailscale_key_delete — revoke/delete an auth key (requires confirm)