Automated Tailscale Key Expiry Reminders
Every Monday, WebRun opens Tailscale, lists the devices and auth keys whose expiry falls in the next 14 days, drafts a heads-up email to each owner in Gmail, and books a rotation slot in Google Calendar before anything drops off the network.
How do I get warned before Tailscale device keys expire?
WebRun checks your Tailscale admin console every Monday for devices and auth keys expiring within 14 days. It drafts a heads-up email to each owner in Gmail, leaves it unsent for your approval, and books a rotation block in Google Calendar before the earliest expiry, so nothing silently falls off your tailnet.
- Owners hear about an expiring key two weeks early, not after they lose access
- Rotation work is on the calendar before the first expiry date
- No device silently drops off the tailnet over a weekend
Built for IT admins · DevOps teams · security engineers · remote-first companies
What does WebRun do on every run?
The exact actions WebRun takes, in order - in plain language, so you can adjust anything.
-
WebRun signs in and gets to work
Opens
login.tailscale.comin a real browser with your saved login - no setup, no API keys. -
1
Tailscale - find keys expiring soon
tailscale.com
WebRun opens Tailscale to find keys expiring soon. - Open the Tailscale admin console and go to Machines
- Capture every device whose key expiry falls in the next 14 days
- Check the Keys page for auth keys nearing their expiry date too
- Note the owner, tags, and exact expiry date for each
Done when Every device and auth key expiring in the next 14 days is listed with its owner.
-
2
Gmail - draft owner warnings
gmail.com
WebRun opens Gmail to draft owner warnings. - Draft one short email per owner listing their device, the expiry date, and how to re-authenticate
- Group several devices for the same owner into a single message
- Leave every message unsent in Drafts for you to review and send
Done when Each affected owner has a draft warning waiting for your approval.
-
3
Google Calendar - book rotation time
calendar.google.com
WebRun opens Google Calendar to book rotation time. - Create a rotation block two days before the earliest expiry date
- Put the device count and the owner names in the event description
- Add the Tailscale admin console link so the work starts in one click
Done when A rotation slot sits in your calendar ahead of the first expiry.
How is each run configured?
Secure by default
Connect once, stays signed in
WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.
Every action is checked against this policy before it runs.
Questions, answered
Will it email my team without my approval?
No. Every owner warning is left unsent in Gmail Drafts for you to read and send yourself. WebRun writes the message and stops there.
Does it change anything inside Tailscale?
No. WebRun only reads the Machines and Keys pages. It never disables expiry, rotates a key, or removes a device. All of that stays a human decision.
How far ahead does it warn me?
14 days by default, and you can widen or narrow that window. The calendar rotation block lands two days before the earliest expiry so nothing drops off unannounced.
Related templates
Put this on autopilot.
Turn it on in minutes - or have our team set it up for you.