diff --git a/changelog.mdx b/changelog.mdx
index 5aa02625e..8c1c57d75 100644
--- a/changelog.mdx
+++ b/changelog.mdx
@@ -7,6 +7,19 @@ keywords: ["changelog", "API updates", "release notes", "what's new", "API chang
 
 To subscribe to updates, please [**“Turn on notifications”**](https://help.x.com/en/managing-your-account/notifications-on-mobile-devices#:~:text=In%20the%20top%20menu,%20you,you%20would%20like%20to%20receive) for [**@API**](https://x.com/api). You can also follow this changelog in your feed reader via the [**RSS feed**](https://docs.x.com/changelog/rss.xml).
 
+<Update label="Sep 22, 2026" description="X API v2">
+  ### OAuth 2.0 client secret for webhook CRC and signatures
+
+  Account Activity webhooks now support the **OAuth 2.0 client secret** for CRC challenge responses and event signature verification. The OAuth 1.0 consumer secret continues to work for existing integrations.
+
+  - New `X-Twitter-Webhooks-Signature-OAuth2` header is signed with your app's OAuth 2.0 client secret and is the recommended header to verify.
+  - Legacy `X-Twitter-Webhooks-Signature` header (OAuth 1.0 consumer secret) is unchanged and remains supported for backward compatibility.
+  - Apps configured with both secrets may receive both headers during migration. Prefer the OAuth 2.0 header and fall back to the legacy header if needed.
+  - The OAuth 2.0 App Only Bearer Token used to call `/2/webhooks` is **not** used to compute CRC responses or webhook signatures.
+
+  See the [Webhooks introduction](/x-api/webhooks/introduction) and updated [Quickstart](/x-api/webhooks/quickstart) for Python, Node, and Flask examples using the OAuth 2.0 client secret with constant-time comparison.
+</Update>
+
 <Update label="Sep 17, 2026" description="X Ads API">
   ### Conversion API Google Tag Manager server-side template