Public address & two-factor sign-in

What the public tier is

Most workspaces live on a private network you join with the Tailscale app (see Tailscale, explained). If your team cannot install software on its devices, you can choose a public web address instead: a normal https address that opens in any browser, anywhere.

The address is fronted by Cloudflare. Your instance itself still publishes no ports and keeps no public IP address; Cloudflare’s network carries requests to it through a private tunnel and filters abusive traffic on the way.

Why two-factor sign-in is mandatory

A public address can be reached by anyone, so a leaked or guessed password must not be enough. On the public tier every user signs in with their password and a second factor: a passkey on their device (Touch ID, Windows Hello, a phone, a security key) or a six-digit code from an authenticator app. Your workspace enforces this: an account without one is asked to set it up before it can do anything else.

Passkeys, the quick way

On the setup screen choose Add a passkey, give it a name, and confirm with your device. From then on sign-in is your password plus a fingerprint or face check. Add a second passkey on another device so losing one never locks you out, or keep an authenticator app as well.

Setting up your authenticator

1. Install an authenticator app if you have none: Google Authenticator, Microsoft Authenticator, Apple Passwords, 1Password and Authy all work.
2. On your first sign-in your workspace shows a QR code. Scan it in the app (or type the key by hand), then enter the six digits the app shows.
3. Store the eight recovery codes somewhere safe and offline. Each signs you in once if your phone is lost.
4. Tick Remember this browser for 30 days on devices you use daily; you will only be asked for a code again on a new device or after a month.

Lost your phone?

Use a recovery code to sign in, then set up the authenticator again from the sidebar’s Two-factor sign-in page. Without your recovery codes, an admin on your team can reset your second factor from Users; if you are the only admin, contact the operator.

Switching tiers

Your tier can be changed later by the operator: contact support and say which one you want. Moving to the public tier means everyone sets up an authenticator; moving to the private network means everyone installs Tailscale and accepts a new invite. Either way the instance restarts for a minute or two.