> ## Documentation Index
> Fetch the complete documentation index at: https://developers.authlete.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authlete 3.0 Release Notes - April 2026

##### Version Number : 3.0.31

# Overview

This minor update introduces changes for Authlete 3.0.
This new version is available from April 30th (Thu).

# New Features & Improvements

## Client deletion improvements

Added cleanup queue to client deletion flow in order to minimize impact when working with a large number of entities.

## Flexible service tokens

Added the following permissions to Service Access Tokens :

* `VIEW_SERVICE`
* `VIEW_CLIENT`
* `USE_INTROSPECTION`
* `USE_SERVICE`
* `CREATE_CLIENT`
* `MODIFY_CLIENT`
* `MODIFY_SERVICE`

For further details, please consult [our documentation](/deployment-and-operations/access-control/service-access-tokens).

## Authorization Code Duration

Implemented capability to set `authorization_code_duration` at service level.

# Specs support

## OID4VCI update

Updated OID4VCI implementation to include Key Attestation signature verification feature.

## HAIP support

Implemented the required validation steps and service properties to support HAIP specification.

* Allows [OAuth 2.0 Attestation-Based Client Authentication (ABCA)](https://datatracker.ietf.org/doc/draft-ietf-oauth-attestation-based-client-auth/) as a client authentication method
* When client authentication method is ABCA, will perform additional validation on Client Attestation JWT and Client Attestation PoP JWT
* When [OpenID for Verifiable Credential Issuance (OID4VCI)](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html) is enabled, will verify that the `scope` parameter includes values referring to credential configurations
* Always requires DPoP [(RFC 9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP))](https://www.rfc-editor.org/rfc/rfc9449.html)
* For more information on HAIP, documentation is available [here](https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0.html)

# Bug fixes

## Missing request body fix

Fixed an issue where a request missing a request body would result in an empty 400 error.

# Other

N/A