Use OAuth 2.0 Pushed Authorization Requests (PAR) per RFC 9126

Steps

1. Discover the PAR endpoint from the authorization server metadata document (/.well-known/oauth-authorization-server or /.well-known/openid-configuration) by reading the pushed_authorization_request_endpoint field
2. POST the full authorization request parameters (client_id, response_type, scope, redirect_uri, code_challenge, state, etc.) to the pushed_authorization_request_endpoint using client authentication (client_secret_basic or private_key_jwt)
3. Receive a JSON response containing request_uri (a urn:ietf:params:oauth:request_uri:... value) and expires_in seconds
4. Redirect the user-agent to the authorization endpoint with only client_id and request_uri as query parameters — omit all other parameters
5. Complete the standard authorization code flow: receive the code at your redirect_uri, then POST to the token endpoint to exchange it for tokens
6. Check the server metadata field require_pushed_authorization_requests (boolean) — if true, the server rejects direct authorization requests not submitted via PAR