# Agent-side auth workaround for tailscale up

`tailscale up` blocks until browser auth completes. The agent can't visit the URL.

## Symptom

```
sudo tailscale up
# prints: To authenticate, visit: https://login.tailscale.com/a/...
# hangs forever → timeout after 60-300s
```

Each run generates a fresh URL. The URL from a previous run is stale.

## Workflow that works

1. `tailscale status` — confirms "Logged out" and prints the current auth URL
2. Give the URL to the user
3. `sudo tailscale up 2>&1` in background with `notify_on_complete=true, timeout=300`
4. User authenticates in browser → process exits → agent notified

## Why foreground fails

Foreground `tailscale up` with timeout will always hit the timeout unless the user is fast. Background + notify_on_complete is the right pattern because the agent gets a push notification when auth completes, rather than polling or timing out.

## Auth key alternative

If the user has a pre-generated auth key from the Tailscale admin console:
```bash
sudo tailscale up --authkey tskey-client-<key>
```
This completes instantly with no browser step. Generate keys at https://login.tailscale.com/admin/settings/keys