From bfa59debc63e5fa199876df172c0b9d76a87ecd1 Mon Sep 17 00:00:00 2001
From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com>
Date: Tue, 22 Sep 2026 18:02:48 +0000
Subject: [PATCH] docs: add changelog entry for OAuth 2.0 webhook secret
support
---
changelog.mdx | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/changelog.mdx b/changelog.mdx
index 5aa02625e..8c1c57d75 100644
--- a/changelog.mdx
+++ b/changelog.mdx
@@ -7,6 +7,19 @@ keywords: ["changelog", "API updates", "release notes", "what's new", "API chang
To subscribe to updates, please [**“Turn on notifications”**](https://help.x.com/en/managing-your-account/notifications-on-mobile-devices#:~:text=In%20the%20top%20menu,%20you,you%20would%20like%20to%20receive) for [**@API**](https://x.com/api). You can also follow this changelog in your feed reader via the [**RSS feed**](https://docs.x.com/changelog/rss.xml).
+
+ ### OAuth 2.0 client secret for webhook CRC and signatures
+
+ Account Activity webhooks now support the **OAuth 2.0 client secret** for CRC challenge responses and event signature verification. The OAuth 1.0 consumer secret continues to work for existing integrations.
+
+ - New `X-Twitter-Webhooks-Signature-OAuth2` header is signed with your app's OAuth 2.0 client secret and is the recommended header to verify.
+ - Legacy `X-Twitter-Webhooks-Signature` header (OAuth 1.0 consumer secret) is unchanged and remains supported for backward compatibility.
+ - Apps configured with both secrets may receive both headers during migration. Prefer the OAuth 2.0 header and fall back to the legacy header if needed.
+ - The OAuth 2.0 App Only Bearer Token used to call `/2/webhooks` is **not** used to compute CRC responses or webhook signatures.
+
+ See the [Webhooks introduction](/x-api/webhooks/introduction) and updated [Quickstart](/x-api/webhooks/quickstart) for Python, Node, and Flask examples using the OAuth 2.0 client secret with constant-time comparison.
+
+
### Conversion API Google Tag Manager server-side template