diff --git a/cmd/get-authkey/main.go b/cmd/get-authkey/main.go
index eb826c12e..f638847bf 100644
--- a/cmd/get-authkey/main.go
+++ b/cmd/get-authkey/main.go
@@ -35,6 +35,10 @@ func main() {
 		log.Fatal("TS_API_CLIENT_ID and TS_API_CLIENT_SECRET must be set")
 	}
 
+	if *tags == "" {
+		log.Fatal("at least one tag must be specified")
+	}
+
 	baseUrl := os.Getenv("TS_BASE_URL")
 	if baseUrl == "" {
 		baseUrl = "https://api.tailscale.com"