From 6ef834a6b7ed58271fa6590a9b50859a3420ee77 Mon Sep 17 00:00:00 2001
From: Will Norris <will@tailscale.com>
Date: Wed, 8 Feb 2023 16:06:48 -0800
Subject: [PATCH] get-authkey: require tags to be specified

Tailnet-owned auth keys (which all OAuth-created keys are) must include tags, since there is no user to own the registered devices.

Signed-off-by: Will Norris <will@tailscale.com>
---
 cmd/get-authkey/main.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/cmd/get-authkey/main.go b/cmd/get-authkey/main.go
index eb826c12e..f638847bf 100644
--- a/cmd/get-authkey/main.go
+++ b/cmd/get-authkey/main.go
@@ -35,6 +35,10 @@ func main() {
 		log.Fatal("TS_API_CLIENT_ID and TS_API_CLIENT_SECRET must be set")
 	}
 
+	if *tags == "" {
+		log.Fatal("at least one tag must be specified")
+	}
+
 	baseUrl := os.Getenv("TS_BASE_URL")
 	if baseUrl == "" {
 		baseUrl = "https://api.tailscale.com"