Tailscale setup

The app runs an embedded Tailscale node. Authorize it either by signing in with your Tailscale account in the browser, or by pasting a pre-authorised key — no separate Tailscale app required.

Option A: Browser sign-in (Recommended)

No key to generate or copy. The app shows you a one-time sign-in link the first time the node needs authorizing.

Open Settings → Tailscale in the app.
Leave the Tailscale Auth Key field blank.
Tap Start Node.
A "Sign in to Tailscale" banner appears with an Authorize in Browser button — tap it.
Sign in with your Tailscale account in the browser tab that opens, then return to the app. The node connects automatically once authorized.

Option B: Auth key

Useful for headless setups, or if you want the node pre-authorized before you ever open the app.

Open the Tailscale admin console's Keys page.
Tap Generate auth key.
Choose Reusable if you expect to start this node more than once with the same key — a one-off key only authorizes a single connection. Choose Ephemeral only if the node should be removed from your tailnet automatically when it disconnects; leave it unchecked for a node you want to keep reappearing under the same identity. Add tags if your tailnet's ACLs are tag-based.
Copy the generated key (it starts with tskey-auth-).
In the app, paste it into Settings → Tailscale → Tailscale Auth Key and tap Start Node.

Self-hosted control servers (Headscale)

The Control Plane URL field in the same screen is configurable, so the app works with Headscale or any compatible coordination server instead of Tailscale's hosted service. Point it at your server's URL before starting the node; both authorization options above work the same way against a self-hosted control plane.

If it fails

"Sign in to Tailscale" banner never appears: The node may already be authorized from a previous session, or a stale auth key was rejected silently — check the error text below the Start/Stop buttons.
Auth key rejected: One-off (non-reusable) keys only work once. Generate a new key, or use browser sign-in instead.
Node starts but no peers are visible: Check the tailnet's ACLs — a tagged key restricted by policy may connect but not be granted routes to other devices.
Connecting to a self-hosted control server fails: Confirm the Control Plane URL is reachable from the phone and matches your Headscale server's address exactly, including scheme.