diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go
index e0af0c656..89b2562a9 100644
--- a/ipn/ipnlocal/local.go
+++ b/ipn/ipnlocal/local.go
@@ -213,6 +213,7 @@ func (b *LocalBackend) UpdateStatus(sb *ipnstate.StatusBuilder) {
 	defer b.mu.Unlock()
 
 	sb.SetBackendState(b.state.String())
+	sb.SetAuthURL(b.authURL)
 
 	// TODO: hostinfo, and its networkinfo
 	// TODO: EngineStatus copy (and deprecate it?)
diff --git a/ipn/ipnstate/ipnstate.go b/ipn/ipnstate/ipnstate.go
index c1232f335..b89f7bb08 100644
--- a/ipn/ipnstate/ipnstate.go
+++ b/ipn/ipnstate/ipnstate.go
@@ -27,6 +27,7 @@ import (
 // Status represents the entire state of the IPN network.
 type Status struct {
 	BackendState string
+	AuthURL      string       // current URL provided by control to authorize client
 	TailscaleIPs []netaddr.IP // Tailscale IP(s) assigned to this node
 	Self         *PeerStatus
 
@@ -110,6 +111,12 @@ func (sb *StatusBuilder) SetBackendState(v string) {
 	sb.st.BackendState = v
 }
 
+func (sb *StatusBuilder) SetAuthURL(v string) {
+	sb.mu.Lock()
+	defer sb.mu.Unlock()
+	sb.st.AuthURL = v
+}
+
 func (sb *StatusBuilder) SetMagicDNSSuffix(v string) {
 	sb.mu.Lock()
 	defer sb.mu.Unlock()