Google auth but you can run your OIDC provider if you're into that: https://tailscale.com/kb/1240/sso-custom-oidc.

My nodes identify themselves with keys signed by the other nodes as per tailnet lock: https://tailscale.com/kb/1226/tailnet-lock