> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/resource-integrations/tailscale.md).

# Tailscale

This guide describes how to connect P0 to your Tailscale network to enable just-in-time SSH access governed by your Tailscale policy file.

### Before you begin

* You must have an active Tailscale account.
* You must have a Tailscale OAuth client with the `all` scope. OAuth clients can be generated from the [OAuth clients](https://login.tailscale.com/admin/settings/oauth) page of the admin console provided you have either an **Owner**, **Admin**, or **Network admin** role. P0 uses the client's **Client ID** and **Client secret**.
* P0 manages access by dynamically inserting temporary grants into your Tailscale policy file. Ensure you are comfortable with an automated service managing these grants.
* Installed the [P0 CLI package](https://github.com/p0-security/p0cli) if you are making requests through PO CLI.

### Setting up Tailscale

The installation process involves generating an OAuth client in Tailscale and providing its Client ID and Client secret to P0.

1. Navigate to the **Integrations** page on [p0.app](https://p0.app), under **Resources** click **Tailscale**.

   <figure><img src="/files/PVh19yyY153c2jo7PRVx" alt="P0 Integrations page with Tailscale selected." width="375"><figcaption></figcaption></figure>
2. Click the **Tailscale policy management**.

   <figure><img src="/files/vi7zBvJtVsnftfwkxVfV" alt="Tailscale policy management page in P0." width="563"><figcaption></figcaption></figure>
3. Click **Add organization**. Give an **Organization identifier** and click **Next**.
4. Enter your **Client ID** and **Client secret**.
5. Click **Finish**.

{% hint style="success" %}
Congratulations! You have successfully set up Tailscale for P0. You can return to the Tailscale policy management page at any time to update the credentials by toggling on **Hash**.
{% endhint %}