Authkey is set; but state is NoState. Ignoring authkey. Re-run with TSNET_FORCE_LOGIN=1 to force use of authkey.

[dazzag24]

After a restart of the docker-compose based tsidp, I see this in the logs:

tsidp  | 2026/01/08 09:19:46 tsnet running state path /data/tailscaled.state
tsidp  | 2026/01/08 09:19:46 tsnet starting with hostname "idp", varRoot "/data"
tsidp  | 2026/01/08 09:19:46 Authkey is set; but state is NoState. Ignoring authkey. Re-run with TSNET_FORCE_LOGIN=1 to force use of authkey.
tsidp  | 2026/01/08 09:19:47 INFO tsidp server started server_url=https://idp.xxxxxx-zzzzzz.ts.net
tsidp  | 2026/01/08 09:19:51 AuthLoop: state is Running; done

my compose.yaml:

services:
  tsidp:
    container_name: tsidp
    image: ghcr.io/tailscale/tsidp:latest
    volumes:
         - ./data:/data
    environment:
      - TAILSCALE_USE_WIP_CODE=1 # tsidp is experimental - needed while version <1.0.0
      - TS_STATE_DIR=/data # store persistent tsnet and tsidp state
      - TS_HOSTNAME=idp # Hostname on tailnet (becomes idp.your-tailnet.ts.net)
      - TSIDP_ENABLE_STS=1 # Enable OAuth token exchange
      # Optional: Tailscale auth key for automatic node registration
      - TS_AUTHKEY=tskey-auth-REDACTED

The web interface is not available.

[dazzag24]

Adding TSNET_FORCE_LOGIN=1 to my compose.yaml and restarting:

tsidp  | 2026-01-08T09:29:04.460446386Z 2026/01/08 09:29:04 tsnet running state path /data/tailscaled.state
tsidp  | 2026-01-08T09:29:04.463072179Z 2026/01/08 09:29:04 tsnet starting with hostname "idp", varRoot "/data"
tsidp  | 2026-01-08T09:29:04.465624861Z 2026/01/08 09:29:04 LocalBackend state is NoState; running StartLoginInteractive...
tsidp  | 2026-01-08T09:29:05.060154109Z 2026/01/08 09:29:05 INFO tsidp server started server_url=https://idp.xxxxxx-zzzzz.ts.net
tsidp  | 2026-01-08T09:29:09.466874226Z 2026/01/08 09:29:09 AuthLoop: state is Running; done

and now the web interface is available.

So perhaps this env var could be added to the example docker-compose file in the README?