# Pushed Authorization Request

`POST /oauth/oidc/par`

Send the authorization request to TrueVault server to server (RFC 9126), then redirect the browser with only `client_id` and the returned `request_uri`. The browser never carries `claims`, `email`, `phone` or `ruleset`, nothing on the way can edit them, and the authorize URL stays under 200 bytes however many claims you ask for.

Recommended for every confidential client. Public clients have no secret to authenticate the push and use the direct authorization request instead. Optional: `require_pushed_authorization_requests` is `false` in the discovery document.

### Client authentication
Authenticate the way your client authenticates at the token endpoint - either the `Authorization: Basic` header (`client_secret_basic`) or `client_id` and `client_secret` in the form body (`client_secret_post`), never both.

### Steps
1. Generate PKCE `code_verifier` and `code_challenge`, plus `state` and `nonce`
2. POST the authorization parameters here when the person clicks, not at page render
3. Redirect the browser to the authorization endpoint with `client_id` and `request_uri`
4. Continue as normal: callback, token exchange, userinfo

Each `request_uri` works once and expires after 10 minutes. Pushed parameters are deleted when the `request_uri` is used, or when it expires unused.

Parameters, request body, responses and error codes for this
endpoint are generated from the OpenAPI description. Read it at
/dist/docs/openapi.yaml for the machine-readable version.