Public address & two-factor sign-in

What the public tier is

If your team cannot install Tailscale, your workspace can use a public web address instead: a normal https address that opens in any browser. Cloudflare sits in front of it and filters abusive traffic.

Why two-factor sign-in is mandatory

Anyone can reach a public address, so every user signs in with their password and a passkey (Touch ID, Windows Hello, a phone or a security key) or a code from an authenticator app. Accounts without one must set it up first.

Adding a passkey

Choose Add a passkey, name it and confirm on your device. Add a second passkey or an authenticator app so losing one device does not lock you out.

Setting up your authenticator

1. Install an authenticator app, such as Google Authenticator, Microsoft Authenticator, Apple Passwords, 1Password or Authy.
2. Scan the QR code your workspace shows (or type the key), then enter the six-digit code.
3. Store the eight recovery codes somewhere safe and offline. Each signs you in once without your phone.
4. On devices you use daily, tick Remember this browser for 30 days.

Lost your phone?

Sign in with a recovery code, then set up two-factor again from Two-factor sign-in in the account menu. Without recovery codes, another admin can reset it under Users; if you are the only admin, contact us.

Switching tiers

Contact us to switch. Moving to the public tier means everyone sets up two-factor sign-in; moving to the private network means everyone installs Tailscale and accepts an invite. The workspace restarts for a minute or two.