Security settings
What lives on the Security page, who can use each part of it, and what belongs to your account instead.
Three things live on the Security page under Settings, and they have less in common than the grouping suggests. Each opens a page of its own.
| Section | Page | What it is | Who can use it |
|---|---|---|---|
| Network | Tailscale | Putting your screens on your private network | Owner and Admin |
| Single sign-on | SAML single sign-on | Sign-in through your own identity provider | Owner only |
| API access | API tokens | Tokens for the API, the CLI, and AI agents connected over MCP | Owner and Admin |
API tokens
A token authenticates to the API, the CLI, and the MCP server, and carries the permissions of the account that created it.
It is shown once and never again. A name you already use for another token is turned down with Token name already in use. See API tokens.
SAML single sign-on
Enterprise, Owner only. See Single sign-on.
Tailscale
You connect Tailscale under Settings > Integrations, then turn on Tailscale on screens here. It sits under Security because it is about what your devices can reach rather than what the dashboard connects to: it puts screens on your own Tailscale network so they can display internal dashboards and intranet pages.
ScreenlyOS only. See Reaching your private network.
What is not here
Passkeys and two-factor authentication are personal, under your account settings rather than the workspace. They are how you sign in, and they work across every workspace you belong to.
Privacy mode is per screen, on that screen's Actions tab, not a workspace setting.