diff --git a/client/tailscale/keys.go b/client/tailscale/keys.go
index ddd0c94fe..1713182ef 100644
--- a/client/tailscale/keys.go
+++ b/client/tailscale/keys.go
@@ -72,7 +72,10 @@ func (c *Client) Keys(ctx context.Context) ([]string, error) {
 // can be created. Returns the key itself, which cannot be retrieved again
 // later, and the key metadata.
 func (c *Client) CreateKey(ctx context.Context, caps KeyCapabilities) (string, *Key, error) {
-	bs, err := json.Marshal(caps)
+	keyRequest := struct {
+		Capabilities KeyCapabilities `json:"capabilities"`
+	}{caps}
+	bs, err := json.Marshal(keyRequest)
 	if err != nil {
 		return "", nil, err
 	}