Authkey is set; but state is NoState. Ignoring authkey. Re-run with TSNET_FORCE_LOGIN=1 to force use of authkey.

After a restart of the docker-compose based tsidp, I see this in the logs:

tsidp  | 2026/01/08 09:19:46 tsnet running state path /data/tailscaled.state
tsidp  | 2026/01/08 09:19:46 tsnet starting with hostname "idp", varRoot "/data"
tsidp  | 2026/01/08 09:19:46 Authkey is set; but state is NoState. Ignoring authkey. Re-run with TSNET_FORCE_LOGIN=1 to force use of authkey.
tsidp  | 2026/01/08 09:19:47 INFO tsidp server started server_url=https://idp.xxxxxx-zzzzzz.ts.net
tsidp  | 2026/01/08 09:19:51 AuthLoop: state is Running; done

my compose.yaml:

services:
  tsidp:
    container_name: tsidp
    image: ghcr.io/tailscale/tsidp:latest
    volumes:
         - ./data:/data
    environment:
      - TAILSCALE_USE_WIP_CODE=1 # tsidp is experimental - needed while version <1.0.0
      - TS_STATE_DIR=/data # store persistent tsnet and tsidp state
      - TS_HOSTNAME=idp # Hostname on tailnet (becomes idp.your-tailnet.ts.net)
      - TSIDP_ENABLE_STS=1 # Enable OAuth token exchange
      # Optional: Tailscale auth key for automatic node registration
      - TS_AUTHKEY=tskey-auth-REDACTED

The web interface is not available.

Start by reproducing the restart with the provided compose.yaml, persistent /data volume, and TS_AUTHKEY setting, then inspect the tsidp startup and tsnet authentication logs. Done means the web interface is available after restart and the service no longer ignores the authkey unexpectedly.