PAR

Pushed Authorization Requests (RFC 9126). The client sends authorization parameters directly to the server over a back channel first, hardening the flow against tampering. Required by stricter profiles like FAPI.