Pushed Authorization Request

POST /oauth/oidc/par

Send the authorization request to TrueVault server to server (RFC 9126), then redirect the browser with only client_id and the returned request_uri. The browser never carries claims, email, phone or ruleset, nothing on the way can edit them, and the authorize URL stays under 200 bytes however many claims you ask for.

Recommended for every confidential client. Public clients have no secret to authenticate the push and use the direct authorization request instead. Optional: require_pushed_authorization_requests is false in the discovery document.

Client authentication

Authenticate the way your client authenticates at the token endpoint - either the Authorization: Basic header (client_secret_basic) or client_id and client_secret in the form body (client_secret_post), never both.

Steps

Generate PKCE code_verifier and code_challenge, plus state and nonce
POST the authorization parameters here when the person clicks, not at page render
Redirect the browser to the authorization endpoint with client_id and request_uri
Continue as normal: callback, token exchange, userinfo

Each request_uri works once and expires after 10 minutes. Pushed parameters are deleted when the request_uri is used, or when it expires unused.

Request body

Content type application/x-www-form-urlencoded

Fields

Field	Type	Required	Description
`client_id`	string	no	Only when the client authenticates with `client_secret_post`. Leave it out when sending the `Authorization: Basic` header - a push carrying both is rejected.
`client_secret`	string	no	Only when the client authenticates with `client_secret_post`.
`response_type`	string	yes	Must be `code` for Authorization Code flow. One of: `code`
`redirect_uri`	string	yes	Must exactly match a redirect URI registered for the client.
`scope`	string	yes	Space-separated scopes. Must include `openid`.
`state`	string	yes	Opaque value your application checks on the callback.
`nonce`	string	no	Bound into the `id_token` for replay protection.
`code_challenge`	string	yes	`BASE64URL(SHA256(code_verifier))`.
`code_challenge_method`	string	yes	One of: `S256`
`claims`	string	no	JSON claims request, e.g. `{"true":["trueidentity.valid"]}`. Sent as a string.
`ruleset`	string	no	A ruleset enabled on the client. Defaults to the client's default ruleset.
`aobo`	string	no	Delegation uid when acting on behalf of another relying party.
`phone`	string	no	Pre-seed the person's phone number.
`phone_country_code`	string	no	Country code for `phone`.
`email`	string	no	Pre-seed the person's email address.

Example request body

{
  "client_id": "string",
  "client_secret": "string",
  "response_type": "code",
  "redirect_uri": "string",
  "scope": "openid profile",
  "state": "string",
  "nonce": "string",
  "code_challenge": "string",
  "code_challenge_method": "S256",
  "claims": "{\"true\":[\"trueidentity.valid\"]}",
  "ruleset": "string",
  "aobo": "string",
  "phone": "string",
  "phone_country_code": "61",
  "email": "string"
}

Responses

Status	Description
`201 Created`	Request stored. Redirect the browser with `client_id` and this `request_uri`.
`400 Bad Request`	`invalid_request`: no `client_id` in the header or body, or `response_type` or `scope` missing.
`401 Unauthorized`	`invalid_client`: unknown client, wrong secret, or credentials in both the header and the body. `unauthorized_client`: the client is public.
`405`	`invalid_request`: the endpoint only accepts POST.

Content type application/json

PushedAuthorizationResponse (201)

Field	Type	Required	Description
`request_uri`	string	yes	Opaque reference to the pushed request. Single use. Pass it, with `client_id`, to the authorization endpoint.
`expires_in`	integer	yes	Seconds the `request_uri` stays valid. Always 600.

Example 201 response

{
  "request_uri": "urn:ietf:params:oauth:request_uri:cPkc0bdMi3tYpeEYAPR57ZizsansgCuf",
  "expires_in": 600
}