What Are OAuth Pushed Authorization Requests (PAR)?

Blog Discussions
, ,
4

Hi Robertino,

I have a question if you can guide me for the solution:

I have three applications:

  1. Our own SSO that supports Authorization Code + PKCE
  2. A Client UI App
  3. A Client API App

The Client UI App authenticates through our SSO and interacts with the Client API App’s endpoints.

Now, if I want to implement Pushed Authorization Requests (PAR), where should I place the initial request to obtain the request_uri within this Client UI and API structure?

Since the PAR request to obtain the request_uri must be a back-channel request, where should it be initiated?