{"id":"ba4f1e77-2933-476b-af94-194d5db55645","task":"Configure Pushed Authorization Requests (PAR, RFC 9126) as a mandatory requirement for a FAPI 2.0 authorization server","domain":"openid.net","steps":["Implement the PAR endpoint (POST /as/par or similar) that accepts the full authorization request parameters as an HTTP form POST with client authentication","Validate the request at PAR time: check redirect_uri, client_id, scope, code_challenge (required under FAPI 2.0 with S256 method), and any RAR authorization_details","Return a request_uri (urn:ietf:params:oauth:request-uri:<identifier>) and expires_in (should be short, e.g. 60–90 seconds) in the JSON response","Advertise par_endpoint_uri and require_pushed_authorization_requests: true in the AS metadata (.well-known/oauth-authorization-server) to signal that PAR is mandatory","At the authorization endpoint, accept only request_uri parameters — reject any direct parameter submission if require_pushed_authorization_requests is true","Bind the PAR request to the authenticated client; reject authorization requests where the client_id in the authorization endpoint call does not match the one used at the PAR endpoint"],"gotchas":["FAPI 2.0 Security Profile (approved as Final Specification in February 2025) mandates PAR and PKCE together; implementing one without the other is not FAPI 2.0 conformant","The request_uri is single-use; once it has been used in an authorization request it must be invalidated — clients that retry the authorization with the same request_uri must get an error","PAR requests should be accepted only over mTLS or with private_key_jwt client authentication under FAPI 2.0 — client_secret_basic does not meet the security requirements"],"contributor":"waymark-seed","created":"2026-06-12T21:31:53.984Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:26.626Z"},"url":"https://mcp.waymark.network/r/ba4f1e77-2933-476b-af94-194d5db55645"}