Tailscale Provider

Installation

The Tailscale provider is available as a package in all Pulumi languages:

• JavaScript/TypeScript: @pulumi/tailscale
• Python: pulumi-tailscale
• Go: github.com/pulumi/pulumi-tailscale/sdk/go/tailscale
• .NET: Pulumi.Tailscale
• Java: com.pulumi/tailscale

Example Usage

# Pulumi.yaml provider configuration file
name: configuration-example
runtime:
config:
    tailscale:apiKey:
        value: 12345
    tailscale:tailnet:
        value: example.com

Configuration Reference

• apiKey (String, Sensitive) The API key to use for authenticating requests to the API. Can be set via the TAILSCALE_API_KEY environment variable. Conflicts with ‘oauth_client_id’ and ‘oauth_client_secret’.
• baseUrl (String) The base URL of the Tailscale API. Defaults to https://api.tailscale.com. Can be set via the TAILSCALE_BASE_URL environment variable.
• identityToken (String, Sensitive) The jwt identity token to exchange for a Tailscale API token when using a federated identity client. Can be set via the TAILSCALE_IDENTITY_TOKEN environment variable. Conflicts with ‘api_key’ and ‘oauth_client_secret’.
• oauthClientId (String) The OAuth application’s ID when using OAuth client credentials. Can be set via the TAILSCALE_OAUTH_CLIENT_ID environment variable. Either ‘oauth_client_secret’ or ‘identity_token’ must be set alongside ‘oauth_client_id’. Conflicts with ‘api_key’.
• oauthClientSecret (String, Sensitive) The OAuth application’s secret when using OAuth client credentials. Can be set via the TAILSCALE_OAUTH_CLIENT_SECRET environment variable. Conflicts with ‘api_key’ and ‘identity_token’.
• scopes (List of String) The OAuth 2.0 scopes to request when generating the access token using the supplied OAuth client credentials. See https://tailscale.com/kb/1215/oauth-clients/#scopes for available scopes. Only valid when both ‘oauth_client_id’ and ‘oauth_client_secret’ are set.
• tailnet (String) The tailnet ID. Tailnets created before Oct 2025 can still use the legacy ID, but the Tailnet ID is the preferred identifier. Can be set via the TAILSCALE_TAILNET environment variable. Default is the tailnet that owns API credentials passed to the provider.
• userAgent (String) User-Agent header for API requests.