Workspace VMs are not directly reachable from the public internet. Instead of exposing individual ports, the platform connects all VMs and your devices in a private network based on Tailscale. You therefore need Tailscale whenever you connect to a workspace VM, whether you open the RDP desktop, use Code Server or other workspace apps in the browser, or want to reach a local service on the VM.
Sign-in does not go through tailscale.com but through the platform’s own coordination server (Headscale) at https://headscale.application-platform.com. That is why you enter a custom server in the Tailscale app or use the login command with this address. You set this up once per device. When a workspace is created, the platform checks whether the assigned person has already signed in.
Installing Tailscale and signing in
The steps differ by device. Follow the guide for macOS, Linux, Windows, iOS, or Android. The installers for all systems are on the Tailscale download page.
On macOS and Windows you can also sign in from the terminal instead of the app. The command is also shown in the Connect dialog of your workspace:
tailscale login --login-server=https://headscale.application-platform.com
The command opens a sign-in page in the browser. After signing in, your device can resolve and reach the workspace hostnames. RDP and SSH use MagicDNS names of the form workspace-<slug>.workspaces.vpn.application-platform.com, not the public gateway domain workspaces-dev.application-platform.com.
Checking that the connection is up
The Tailscale app shows the status Connected, and in the terminal tailscale status lists the devices in the network, including your workspace VM. Then open the Connect dialog in the web interface again; from there you download the RDP file or start workspace apps such as Code Server. If the connection is not up, first check whether Tailscale is running and whether you really signed in to the platform’s server. What happens after signing in is described under Connect to your workspace.