The tailscale addon currently requires a user-generated API key in order to operate. Tailscale itself supports OAuth, though, with a provided client ID / client secret that would allow the API token to be regenerated every hour with the right scopes, without needing to be constantly updated.
It’d be grand to have OAuth support for this addon!