Connecting Tailscale to Stacktic

For: a Tailscale admin. Takes about 5 minutes.

What this integration does

Connecting Tailscale lets Stacktic see everyone in your private network and their role. Tailscale calls that network your tailnet. When someone leaves, Stacktic can remove their Tailscale user and every device it owns in one step.

To connect, you create an API access token in the Tailscale admin console. This token is personal, unlike a credential for a service account. It's created by one Tailscale user and has that user's permissions. Stacktic stores it encrypted.

Stacktic needs:

Value	What it is
API access token	A token you create on the admin console's Keys page.
Tailnet	Optional. Your tailnet's name. Leave it blank to use the token's own default tailnet.

Before you start

You need to be able to create an API access token in your Tailscale admin console.
(Optional) Know the name of the tailnet you want to connect, if it's different from the one the token belongs to.

Step 1: Create an API access token

In the Tailscale admin console, go to Settings → Keys.
Choose Generate access token.
Copy the token. It starts with tskey-api-. You won't be able to see it again once you leave the page.

Tailscale's own docs cover creating and limiting access tokens in more detail: tailscale.com/kb/1101/api.

Access tokens expire. Tailscale limits them to 90 days at most. You don't enter an expiry date in Stacktic. Stacktic reads the token's own expiry automatically, and prompts you to reconnect with a new one as it gets close.

Step 2: Connect in Stacktic

In Stacktic, go to Tools → Tailscale → Integration and enter:

API access token: the tskey-api-… value from Step 1.
Tailnet: optional. Leave it blank unless you need to point at a tailnet other than the token's own.

Click Connect. Stacktic lists your tailnet's users to confirm the token is valid, and the tailnet too, if you entered one.

Step 3: Turn on removal (when you're ready)

Stacktic starts reading your tailnet's users as soon as you connect. Removing someone deletes their Tailscale user and every device signed in under it. That's a separate switch, and it's off until you turn it on.

Find Automated user removal on the connected integration. Turn it on when you want Stacktic to do this during offboarding.

What you'll see

Once you're connected, the tool's Access tab lists everyone in your tailnet. Each person shows the role Tailscale uses for them: Owner, Admin, IT admin, Network admin, Billing admin, Auditor, or Member. Stacktic shows Tailscale's own role names here instead of making up its own.

Idle people: someone who hasn't used the tailnet in a while, but can still sign back in any time, still shows as active. Being idle is just a fact about activity, not a lockout.
Suspended people: someone Tailscale has actually suspended shows as deactivated.
Waiting for approval: someone waiting on admin approval to join isn't shown as either, since they don't have access yet.

What removal does (and doesn't do)

Removing a person from Tailscale is a hard delete. It does three things:

deletes their Tailscale user.
revokes any API or auth keys they have.
removes every device signed in under that user. Those devices lose their connection to your tailnet right away.

This can't be undone.

Because it can't be reversed, Stacktic shows you the impact first: the number of devices about to be deleted. So whoever confirms the offboarding step can see what they're about to start before it runs.

It does not:

affect the person outside this tailnet. That includes any other tailnet they belong to, and their personal Tailscale, Google, or Microsoft account.
work if they're the tailnet's only remaining Owner. Tailscale blocks that. Make someone else an Owner first, then retry.

What this doesn't cover

Tailscale lets you share single devices with people outside your tailnet without making them members. A shared-in user can reach whatever was shared with them, and that's real access. But this integration only lists and removes actual tailnet members. Shared users don't show up in Stacktic's list at all.

If your team shares devices with outside collaborators, treat this list as your tailnet's membership. It isn't the complete list of everyone who can reach something on it.

Read-only vs. removal

Connected, removal off (the default): Stacktic shows your tailnet's members and each person's role, next to the rest of your tools.
Automated user removal on: Stacktic also deletes the user and their devices when you offboard them. The owner still confirms each removal, since it can't be reversed.

You can start read-only and turn on removal later without reconnecting.

Security notes

The token is personal. Stacktic's access really belongs to whoever's Tailscale account created the token. If that person leaves your team, reconnect with a new token from someone who's still there.
Tailscale expires it for you. Access tokens last 90 days at most. Stacktic reads the expiry straight from the token, so you don't have to track it. It flags the connection as the expiry gets close.
Stored encrypted. Stacktic keeps the token and tailnet name encrypted. It never shows the full token again. It only shows the last 4 characters, so you can confirm which key is in place.
You can cut it off anytime. Delete the key on the admin console's Keys page. The connection stops working right away.

Troubleshooting

Message in Stacktic	Likely cause and fix
"Tailscale rejected the API key."	The token is wrong, expired, or was revoked. Create a new one (Settings → Keys) and reconnect.
"Tailscale couldn't find the tailnet "…". Leave it blank to use the token's default."	You typed a tailnet the token can't see. Leave the field blank unless you really need a different tailnet.
Offboarding removal fails with a permission-denied message	Most likely you're trying to remove the tailnet's only Owner. Make someone else an Owner in Tailscale first, then retry.
Offboarding removal reports the user wasn't found	They were already removed, or never existed there. Stacktic counts this as done.

Frequently asked questions

Will connecting delete or change anything right away? No. Connecting only reads your tailnet's current user list. Stacktic removes people only during an offboarding, and only after you turn on Automated user removal.

Does this cover everyone who can reach something on my tailnet? It covers tailnet members. It doesn't cover people outside the tailnet you've shared single devices with. See What this doesn't cover.

Do I need to enter my tailnet name? No. Leave it blank and Stacktic uses the tailnet the token belongs to. Only fill it in if you mean to connect a different one.

What happens to someone's devices when Stacktic removes them? All of their devices are removed from the tailnet along with their user. Tailscale can't reverse this. Stacktic shows the device count before the removal runs, so you know the impact up front.

Who can create the access token? Anyone who can reach Settings → Keys in your Tailscale admin console. Tailscale's own docs are the source of truth on which roles that needs: tailscale.com/kb/1101/api.