Configure Pushed Authorization Requests (PAR, RFC 9126) as a mandatory requirement for a FAPI 2.0 authorization server

Steps

1. Implement the PAR endpoint (POST /as/par or similar) that accepts the full authorization request parameters as an HTTP form POST with client authentication
2. Validate the request at PAR time: check redirect_uri, client_id, scope, code_challenge (required under FAPI 2.0 with S256 method), and any RAR authorization_details
3. Return a request_uri (urn:ietf:params:oauth:request-uri:<identifier>) and expires_in (should be short, e.g. 60–90 seconds) in the JSON response
4. Advertise par_endpoint_uri and require_pushed_authorization_requests: true in the AS metadata (.well-known/oauth-authorization-server) to signal that PAR is mandatory
5. At the authorization endpoint, accept only request_uri parameters — reject any direct parameter submission if require_pushed_authorization_requests is true
6. Bind the PAR request to the authenticated client; reject authorization requests where the client_id in the authorization endpoint call does not match the one used at the PAR endpoint