oauth.net
Pushed Authorization Requests (PAR)
PAR lets clients POST their authorization request directly to the authorization server before redirecting the user, returning a short opaque URI that's used in the redirect instead of exposing all parameters in the URL.
When to use this
Use PAR when you need to keep authorization request parameters off the URL — either for security (parameters aren't logged or leaked via referrer headers) or because the request is too large for a URL (as with Rich Authorization Requests). PAR is required by FAPI 2.0 and recommended by the Security BCP for high-security deployments.
Instead of building a long authorization URL with all parameters in the query string, the client first POSTs the authorization request to the PAR endpoint and receives a request_uri. The redirect to the authorization server then uses only that short URI. This moves parameter validation server-side and ensures parameters can't be tampered with in transit.
More resources
- Illustrated PAR: OAuth 2.0 Pushed Authorization Requests (Takahiko Kawasaki)