> ## Documentation Index
> Fetch the complete documentation index at: https://developers.authlete.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authlete 3.0 Release Notes - December 2025

##### Version Number : 3.0.23

# Overview

This minor update introduces changes for Authlete 3.0.
This new version was made available on December 11th (Thu).

# New Features & Improvements

## Cache control improvements

* Consolidated logic to ensure that all applicable endpoints include `Cache-Control: no-store` and `Pragma: "no-cache"` in responses, in accordance to [RFC6749](https://datatracker.ietf.org/doc/html/rfc6749)
* Added new `cluster` and `standalone` caching backends which adds improvements such as adding retries, selective stale cache key deletion and not relying on flush along with using the latest jedis API

## Orphans retrieval improvements

Added a new admin-only endpoint to retrieve orphaned service IDs.

# Specs support

## Support for Client ID Metadata Document (CIMD) Discovery

* This feature was implemented following the [OAuth Client ID Metadata Document (CIMD) specification](https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/)
* This allows OAuth clients to use a URL-based `client_id` and publish their metadata at that location
* Introduced a new request parameter, `cimdOptions`, to the `/auth/authorization`, `/auth/token`, `/backchannel/authentication` and `/device/authorization` endpoints
* Introduced a new `Service` property, `httpAliasProhibited`, which prohibits client ID aliases that start with `https://` or `http://`, in order to prevent possible conflicts between client ID aliases and client IDs in OpenID Federation 1.0 and CIMD
* Introduced the ability to set a metadata policy through the use of the `cimdMetadataPolicyEnabled` and `cimdMetadataPolicy` properties
* The `deleteClientOnUpdateFailure` method in the `CimdUtils` class now removes dependencies from other tables as well

## Support for OID4VCI 1.0 Final

* Implemented support for `credential_request_encryption` (cf. [OID4VCI 1.0 Section 10](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#section-10)), which enables credential requests to be encrypted
* Implemented support for RAR handling
* Updated the implementation of `credential_response_encryption`, removing the `alg` property in favor of including it in the JWK specified by the `jwk` parameter
* Updated the implementation of `c_nonce` in order to issue it from a dedicated endpoint
* Updated the `service` table with columns matching the Credential Issuer Metadata parameters defined in the specification
* Added an `oid4vciVersion` property to `Service` so that Authlete can support multiple versions of the OID4VCI specification

# Bug fixes

## Service Access Token rotation fix

Fixed an issue where an old service access token would remain valid after token rotation.

## Redis flush fix

Fixed an issue where the `redis-cluster` backend would be incorrectly flushed, and improved logging to detect read or write failures to the cache.

## EdDSA signature fix

Fixed an issue where the Nimbus JOSE+JWT library's `JWSVerificationKeySelector` didn't properly handle EdDSA/OKP keys, causing PRIVATE\_KEY\_JWT client authentication and DPoP token validation to fail when using EdDSA signatures.

# Other

N/A