By default, headscale doesn't have a web interface/login as such and all configuration is done via the CLI on the server running headscale. So, your login is effectively PAM. You use authkeys etc to add machines.