debug access denied; to permit access, set TS_ALLOW_DEBUG_IP

Error message

debug access denied; to permit access, set TS_ALLOW_DEBUG_IP=%v

What it means

tsweb.Protected rejected a wrapped debug handler request because AllowDebugAccess failed; in DevMode the message is augmented with the caller's IP and a hint to whitelist it via TS_ALLOW_DEBUG_IP. The remote address is not an authorized debug client.

Source

Thrown at tsweb/tsweb.go:178

		if part == enc {
			return true
		}
	}
	return false
}

// Protected wraps a provided debug handler, h, returning a Handler
// that enforces AllowDebugAccess and returns forbidden replies for
// unauthorized requests.
func Protected(h http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if !AllowDebugAccess(r) {
			msg := "debug access denied"
			if DevMode {
				ipStr, _, _ := net.SplitHostPort(r.RemoteAddr)
				msg += fmt.Sprintf("; to permit access, set TS_ALLOW_DEBUG_IP=%v", ipStr)
			}
			http.Error(w, msg, http.StatusForbidden)
			return
		}
		h.ServeHTTP(w, r)
	})
}

// Port80Handler is the handler to be given to
// autocert.Manager.HTTPHandler.  The inner handler is the mux
// returned by NewMux containing registered /debug handlers.
type Port80Handler struct {
	Main http.Handler
	// FQDN is used to redirect incoming requests to https://<FQDN>.
	// If it is not set, the hostname is calculated from the incoming
	// request.
	FQDN string
}

func (h Port80Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {

View on GitHub (pinned to 6e0912f979)

Solutions

Set TS_ALLOW_DEBUG_IP to include your client IP and retry.

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at tsweb/tsweb.go:178 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/50a65b405b47a694. Report an issue: GitHub.