Pushed Authorization Requests is an OAuth extension that lets a client send its authorization request details directly to the authorization server over a secure back-channel first, receiving a reference to use in the front-channel redirect instead of exposing all request parameters in a browser URL. It reduces the ways an authorization request can be tampered with or leaked, which matters more as automated, non-browser clients like agents participate in these flows.
Frequently asked questions
What problem does PAR actually solve?
It keeps sensitive authorization request parameters out of the browser URL, where they could be logged, leaked, or tampered with.
Does every OAuth client need to support PAR?
Not strictly, but it's increasingly recommended, and required by some stricter deployments, particularly where automated or non-browser clients like agents are involved.
.avif)