Skip to main content
Connect a Tailscale tailnet so Autosana web runners can reach apps that aren’t publicly accessible — staging behind an internal load balancer, split-DNS hostnames, or hosts behind a subnet router.
Private Network Access is for web flows. If your firewall just needs static source IPs, use the Network Allowlist instead — it’s simpler and also covers hooks and mobile runners.

​
How it works

The private network is connected once per workspace and applies to every environment in it — including environments created later.
  1. Connect: a workspace admin gives Autosana a one-time Tailscale API access token (tskey-api-…) and the target URLs. Autosana writes a least-privilege grant to your tailnet policy, mints a scoped credential, and discards the token.
  2. Verify: Autosana joins your tailnet with a short-lived key and confirms each target is reachable.
  3. Run: each web flow run joins the tailnet only for the browser session, routes traffic through it, and leaves when the run ends.
The durable credential is stored encrypted in vault and is never returned by any endpoint. Runs and verification only ever use short-lived, ephemeral keys minted from it.

​
Setup

  1. In Tailscale, make sure your app is reachable from the tailnet (approve subnet router routes if needed)
  2. Create a one-time Tailscale API access token
  3. In Autosana, go to Settings → Integrations → Private Network
  4. Enter your target hosts and ports, e.g. staging.internal.example.com:443
  5. Connect, then run verification before using the network in a web flow
Review the granted CIDRs returned after connecting. An internal DNS name can’t be granted directly in a Tailscale policy, so it resolves to your tailnet’s advertised subnet routes — which can be broader than the hostname suggests. Use an IP or Tailscale device name for the narrowest grant.

​
Troubleshooting

  • Verification can’t reach the target — check the host/port, and that the target is reachable from a device on your tailnet with the needed subnet routes approved.
  • A web run fails to join the network — confirm the workspace’s private network status still shows connected, then retry. Runs fail loudly rather than silently falling back to the public internet.