Pangea Docs FAQ Get early access

Docs / Clouds

Tailscale

Connect a tailnet with OpenID Connect or an OAuth client secret, and let the agent reach private hosts.

Open Connectors → Connect → Tailscale as an Administrator. Enter a label, then choose how Pangea authenticates: OpenID Connect or OAuth client secret. Both exchange for short-lived access tokens. Only the secret-based method stores a credential.

Pangea proves its identity with a signed token each time, so nothing of yours is stored.

  1. In the Tailscale admin console, go to Settings → Trust credentials → New credential.
  2. Choose OpenID Connect.
  3. Issuer URL: https://api.pangea.build.
  4. Subject: your team's subject. Copy it from the dialog in Pangea.
  5. Scopes: auth_keys. Add devices:core to list devices.
  6. Leave Audience empty.
  7. Create the credential, then paste its Client ID into Pangea.

Review the allowed scopes and tags before you save.

Option B: OAuth client secret

  1. In the Tailscale admin console, create an OAuth client and grant only the scopes you need.
  2. Enter its Client ID and Client Secret in Pangea.

The secret is stored encrypted and exchanged for short-lived access tokens. Rotating it means updating the connection.

Verify the connection

Select the binding in a conversation and ask the agent for a bounded device list. Check that you see the expected tailnet and recent device state. A successful token exchange does not grant every Tailscale scope, nor permission to join nodes.

Reach private hosts

With your explicit authorization and the right client scopes, tags and tailnet ACLs, the agent can join as a temporary node and SSH to an intended private host. Selecting the binding alone does not join the tailnet or authorize a scan. SSH and network policy still apply. Confirm the node is removed when the task is done.

For network questions, inspect device and ACL state first. A connectivity check needs an exact target. Provider state alone does not prove an end-to-end connection.

Manage access

Restrict the binding with a member allow-list, and select it only in conversations that need it. Permission modes govern runtime prompts. Tailscale scopes and ACLs enforce the provider boundary.

To end access, remove the binding in Pangea, then delete the trust credential or OAuth client in Tailscale.

← On-prem Kubernetesinstabox →
Questions? augusto@pangea.buildPrivacy · Terms