Android app directory · VPN and access
These are the managed configuration keys Tailscale documents for its Android client, what each one changes on the device, and how to combine them for common rollouts. Several keys take the values always, never or user-decides, which lets you lock a setting or leave it to the person. Tailscale also documents desktop keys; this page covers the ones that apply on Android.
Nomidcom.tailscale.ipn Common setups
Copy a setup into the managed configuration of a policy, then adjust the values. Each one uses only keys explained below.
Sign the device in with a one-off auth key, name it, keep it connected and skip the introduction screens.
{
"AuthKey": "tskey-auth-...",
"Hostname": "warehouse-tablet-07",
"ForceEnabled": true,
"OnboardingFlow": "hide"
}Route two business apps through Tailscale and leave everything else on the normal network, with your name shown in the app.
{
"IncludedPackageNames": "com.example.erp,com.example.crm",
"ManagedByOrganizationName": "Example Ltd",
"ManagedByURL": "https://help.example.com"
}Send all traffic through the exit node you choose and hide the picker so it cannot be changed. Replace the placeholder with that node's device ID from the Machines page of the admin console.
{
"ExitNodeID": "your-exit-node-id",
"ExitNodesPicker": "hide",
"ExitNodeAllowLANAccess": "never"
}Managed configuration
Key names and value types come from the vendor’s documentation. The explanations are written by Nomid.
| Key | Type | What it does | Example |
|---|---|---|---|
| Sign-in and identity | |||
AuthKey | Tailscale auth key | Signs the device in to the tailnet without any user action. Use one-off keys, because a leaked reusable key lets someone else join the network. | tskey-auth-... |
LoginURL | Server address | Points the app at a custom coordination server instead of Tailscale's own, for example a self-hosted one. | https://login.example.com |
Tailnet | Comma-separated tailnet IDs | Suggests which tailnet or organization people should register with. Start the value with required: to enforce it. | required:example.com |
Hostname | Device name | Overrides the name the device reports, so machines show up in the admin console with a name you control. | warehouse-tablet-07 |
| Connection and routing | |||
ExitNodeID | Exit node ID or auto:any | Sends all traffic through the exit node with this device ID. With auto:any, Tailscale selects an exit node automatically instead. Find device IDs on the Machines page of the admin console or through the Tailscale API. | auto:any |
ExitNodeAllowLANAccess | Choice: always, never, user-decides | Decides whether the device can still reach printers and other local devices while an exit node is in use. | never |
IncludedPackageNames | Comma-separated package names | Sends only the listed apps through Tailscale. Every other app bypasses the tunnel once this is set. | com.example.erp,com.example.crm |
ExcludedPackageNames | Comma-separated package names | Keeps the listed apps outside the tunnel for routing and DNS, which suits apps that break behind a VPN. | com.example.streaming |
ForceEnabled | On or off | Keeps Tailscale connected and removes the disconnect switch. Tailscale marks this key as deprecated, so check its page before relying on it. | true |
UseTailscaleSubnets | Choice: always, never, user-decides | Controls whether the device accepts subnet routes advertised by other nodes, which is how it reaches office networks. | always |
UseTailscaleDNSSettings | Choice: always, never, user-decides | Controls whether the device uses the DNS settings from your tailnet while connected. | always |
AllowIncomingConnections | Choice: always, never, user-decides | Lets you block incoming connections to the device, the setting Tailscale calls shields up. | never |
| Interface and branding | |||
ManagedByOrganizationName | Organization name | Shows your company name in the app so people know the device is managed. | Example Ltd |
ManagedByURL | Support page address | Sets the web page that opens when someone taps Support in the app. | https://help.example.com |
ExitNodesPicker | Choice: show, hide | Hides the exit node chooser when you set the exit node yourself and do not want people changing it. | hide |
OnboardingFlow | Choice: show, hide | Skips the first-launch introduction screens, useful when the device is already signed in with an auth key. | hide |
Deploy with Nomid
Find it on Google Play from the policy’s apps list and choose how it is installed.
In the policy, set the app’s managed configuration with the keys and values from this page.
Devices in the policy receive Tailscale and its configuration on their next sync.
Questions
com.tailscale.ipn. Use it to find the app when you add it to a policy.
Tailscale warns that this carries a real security risk. Use a one-off key, set a short expiry and remove the key from the configuration after devices have enrolled.
Once the list is set, only the listed apps go through the tunnel. All other apps use the normal connection.
Yes, the configuration applies to the copy of the app installed in the work profile. Per-app routing then covers only apps in that profile.
Add the app to a Nomid policy, set its configuration and choose its permissions.
