> ## Documentation Index
> Fetch the complete documentation index at: https://developers.authlete.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> ### Authlete versions
> Authlete 3.0 is the current version. Unless the user says they use another version, answer for Authlete 3.0 using the 3.x documentation.
> Documentation for Authlete 2.x (pages under `/v2/` and `/ja/v2/`) is for the legacy version. Refer to it only when the user is on Authlete 2.x.
>
> ### Authlete architecture
> Authlete is a backend engine for OAuth 2.0 and OpenID Connect processing. End users and client applications do not call it directly; the service provider's authorization server and API server call Authlete's APIs. Authlete handles protocol processing and token, client, and service management, while the service provider owns the OAuth/OIDC endpoints and user authentication.
> See [Architecture](https://developers.authlete.com/get-started/introduction-to-authlete/architecture.md).
>
> ### Concepts
> If the user is new to Authlete, read these pages first:
> - [Request and Response](https://developers.authlete.com/get-started/concepts/request-and-response.md): Core API requests pass the client's request parameters as-is, and responses return `resultCode`, `action`, and `responseContent`.
> - [Action Handling](https://developers.authlete.com/get-started/concepts/action-handling.md): Branch on `action`, never on `resultCode`, and map each action to the HTTP response your server returns.
> - [Two-Step API Calls](https://developers.authlete.com/get-started/concepts/two-step-api-calls.md): Actions such as `INTERACTION` are completed with a second call (`/auth/authorization/issue` or `/auth/authorization/fail`) linked by a `ticket`.
> - [Management API Overview](https://developers.authlete.com/get-started/concepts/overview.md): The Management API configures services, manages clients, and operates issued tokens, separately from the protocol flows handled by the Core API.
> - [API Authentication](https://developers.authlete.com/get-started/concepts/authentication.md): Authlete APIs use bearer tokens: a Service Access Token (one service) or an Organization Token (the whole organization).

# Authlete 3.0 Release Notes - October 2026

##### Version Number : 3.0.39

# Overview

This minor update introduces changes for Authlete 3.0.
This new version is available from October 29th (Thu).

# New Features & Improvements

## Full payload service flag

Added new `returnFullPayload` service flag which defaults to true and can be set to false by the user to receive a simplified payload from the applicable endpoints.

# Specs support

N/A

# Bug fixes

## Refresh token deadlock fix

Fixed an issue where refresh token requests (`grant_type=refresh_token`) against the `access_token` table could hit a database deadlock under certain conditions.

## Client token duration validation fix

Fixed an issue where the client update endpoint would not use the same lower bound as the create endpoint when validating the duration of the client token.

## DN name error fix

Fixed an issue where invalid TLS certificate DN names would trigger a `500` error instead of the intended `401`.

## Request URI NPE fix

Fixed an issue where failing to fetch a client's pre-registered `request_uri` would result in a `NullPointerException` instead of the intended `invalid_request_uri` authorization error.

## Grant revoke response fix

Fixed an issue where a grant revoke targeting an unfound grant would result in a `NO_CONTENT (204)` response, instead of the intended `404`.

* This 204 response is used for a successful revoke, which would mislead the caller into thinking that something happened, when in fact the revoke did not have any effect

## Access token cache fix

Fixed an issue where access tokens would keep validating at introspection after a grant revoke, until the cache entry expires naturally.

## Request expiry cap fix

Fixed an issue where a client could make an `auth_req_id` live for an arbitrary time, due to the client-supplied `requested_expiry` being uncapped.

# Other

N/A


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.