changelog: note OAuth clients and scopes

Author: kradalby

CHANGELOG.md

@@ -14,6 +14,19 @@ HTTP API directly.
 
 [#3324](https://github.com/juanfont/headscale/pull/3324)
 
+### OAuth clients and scopes for the v2 API
+
+The v2 API now supports OAuth 2.0 client-credentials, the way the Tailscale
+ecosystem authenticates. OAuth clients are created as `keyType:"client"` on the
+keys endpoint and mint short-lived, scope-limited access tokens at
+`/api/v2/oauth/token`; operations are enforced against the token's scopes, and
+the auth keys a token mints are restricted to its tags or tags those own. The
+`headscale oauthclients` command manages them from the CLI. This lets the
+Tailscale Terraform provider and Kubernetes operator drive Headscale unchanged.
+Admin API keys remain all-access.
+
+[#3334](https://github.com/juanfont/headscale/pull/3334)
+
 ### BREAKING
 
 #### API