tailscale/tailscale · error

lock init access denied

Error message

lock init access denied

What it means

serveTKAInit begins enabling tailnet lock for the tailnet, a privileged write operation. The handler requires PermitWrite; a read-only LocalAPI caller is refused with 403 before any request parsing.

Source

Thrown at ipn/localapi/tailnetlock.go:85

		RotationPublic []byte
	}
	var req signRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		http.Error(w, "invalid JSON body", http.StatusBadRequest)
		return
	}

	if err := h.b.TailnetLockSign(req.NodeKey, req.RotationPublic); err != nil {
		http.Error(w, "signing failed: "+err.Error(), http.StatusInternalServerError)
		return
	}

	w.WriteHeader(http.StatusOK)
}

func (h *Handler) serveTKAInit(w http.ResponseWriter, r *http.Request) {
	if !h.PermitWrite {
		http.Error(w, "lock init access denied", http.StatusForbidden)
		return
	}
	if r.Method != httpm.POST {
		http.Error(w, "use POST", http.StatusMethodNotAllowed)
		return
	}

	type initRequest struct {
		Keys               []tka.Key
		DisablementValues  [][]byte
		SupportDisablement []byte
	}
	var req initRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		http.Error(w, "invalid JSON body", http.StatusBadRequest)
		return
	}

View on GitHub (pinned to 6e0912f979)

Solutions

1. Initialize tailnet lock as an authorized tailnet admin.

When it happens

Trigger: Thrown at ipn/localapi/tailnetlock.go:85 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/56f9ee7f12475a34. Report an issue: GitHub.