Custom OIDC providers ยท Tailscale Docs
https://tailscale.com/kb/1240/sso-custom-oidc
Tailscale can integrate with identity providers that support OpenID Connect (OIDC). The steps provided in this topic are required only for initial creation of a tailnet. After the signup process is completed, Tailscale will work like any other supported identity provider. For more information about OIDC, refer to Welcome to OpenID Connect.
Using your self-hosted Authentik as an Identity Provider for Tailscale
https://blog.antsu.net/custom-tailscale-oidc-provider-with-authentik/
Another cool thing about Tailscale is that they try to keep as little information about their users as possible, and so do not have their own login mechanism, instead leaving this task to common authentication providers like Google and Microsoft, or allowing the use of any identity provider compatible with OpenID Connect, which is the case for Authentik, and the topic of this post.
Pocket ID
https://pocket-id.org/
Pocket ID is a simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.
lastlogin-net/obligator: Simple and opinionated OpenID Connect server designed for self-hosters
https://github.com/lastlogin-net/obligator
Simple and opinionated OpenID Connect server designed for self-hosters