From b693a6177c52aff5e3fab6da164bb76a99d07573 Mon Sep 17 00:00:00 2001
From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com>
Date: Wed, 23 Sep 2026 23:06:43 +0000
Subject: [PATCH] docs: add Sep 23, 2026 changelog entry

---
 changelog.mdx | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/changelog.mdx b/changelog.mdx
index 47c1347f0..aecb10f4c 100644
--- a/changelog.mdx
+++ b/changelog.mdx
@@ -7,6 +7,19 @@ keywords: ["changelog", "API updates", "release notes", "what's new", "API chang
 
 To subscribe to updates, please [**“Turn on notifications”**](https://help.x.com/en/managing-your-account/notifications-on-mobile-devices#:~:text=In%20the%20top%20menu,%20you,you%20would%20like%20to%20receive) for [**@API**](https://x.com/api). You can also follow this changelog in your feed reader via the [**RSS feed**](https://docs.x.com/changelog/rss.xml).
 
+<Update label="Sep 23, 2026" description="X API v2">
+  ### New features
+
+  - **Auto-expiring Activity API subscriptions.** Pass an optional `expires_at` (RFC 3339) when you create an X Activity API subscription, and X deletes it automatically at that time. To change the expiration, create the same subscription again with a new value. See [Subscription expiration](/x-api/activity/introduction#subscription-expiration).
+  - **Webhook signing with your OAuth 2.0 client secret.** Webhook POSTs now include an `X-Twitter-Webhooks-Signature-OAuth2` header signed with your app's OAuth 2.0 client secret. You can also compute CRC responses with this secret. The legacy `X-Twitter-Webhooks-Signature` header and OAuth 1.0 consumer secret remain supported. See [Signature verification](/x-api/webhooks/quickstart#signature-verification).
+  - **Livestream API access form.** Request Livestream API access for your app through the new [Livestream API Access Form](/forms/livestream-api-access). Source and broadcast endpoints are available to approved apps only.
+
+  ### Updates
+
+  - **`is_moderator` in `broadcast.chat` events.** The `broadcast.chat` payload now includes an `is_moderator` boolean for the message author. The broadcast owner is reported as `false`. See [Event payloads](/x-api/activity/event-payloads).
+  - **Broadcast scopes in OAuth 1.0a token exchange.** Exchanged tokens now include `broadcast.read` for Read apps and `broadcast.write` for Read and write apps. See [Migrating OAuth 1.0a user tokens to OAuth 2.0](/fundamentals/authentication/oauth-2-0/oauth-1-0a-token-exchange).
+</Update>
+
 <Update label="Sep 21, 2026" description="X API v2">
   ### Migrate OAuth 1.0a user tokens to OAuth 2.0 with token exchange