> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asteroid.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Tailscale

> Join your tailnet with an auth key, so agents reach the private apps your tailnet routes to.

A **Tailscale** gateway joins your tailnet as a device. Agents then reach any address your tailnet can reach, including subnets behind your subnet routers.

## Prerequisites

Before you start, ensure that:

* **Your plan includes Tailscale.** Scale and above include it. On another plan, the option shows a plan badge; click it to upgrade, or contact the Asteroid team.
* **You have a Tailscale auth key.** Create one in the Tailscale admin console, under **Settings → Keys**:

  * **Reusable.** The gateway runs two devices, and each joins again on every restart.
  * **Ephemeral** (recommended). Old devices then leave the tailnet on their own.
  * **Tags** (recommended). Tag the key, for example `tag:asteroid`, and write ACLs that let that tag reach only the apps your agents need.

  Keys expire after at most 90 days.

## Set it up

1. In **Environments → Gateways**, click **New gateway** and pick **Tailscale**.
2. Name it, paste the auth key, and click **Create gateway**.
3. Wait for **Connected**. The devices appear in your tailnet as `gw-` followed by the gateway's ID.
4. [Pick the gateway on an environment](/networking/overview#use-a-gateway).

The gateway accepts the routes your subnet routers advertise. Addresses outside your tailnet still leave from Asteroid's network.

## Replace the key

Replace the key before it expires. Open the gateway, click **Edit**, enter the **New auth key**, and save. The gateway reconnects with the new key.

## Troubleshooting

| You see | Likely cause | Fix |
| - | - | - |
| The gateway shows **Failed** | The key expired, was revoked, or is not reusable | Create a reusable key and replace it. |
| **Connected**, but an app does not load | Your ACLs block the gateway's tag, or no subnet router advertises the app's range | Check the ACLs and the subnet routes in the Tailscale admin console. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.