Pushed Authorization Requests (PAR), defined in RFC 9126, let an OAuth 2.0 client send its authorization request parameters directly to the authorization server over a secured back channel and receive a request URI to use at the authorization endpoint. This keeps request parameters off the front channel, protects their integrity, and is a required building block of the FAPI security profiles used by open banking and open finance.
Pushed Authorization Requests
Pushed Authorization Requests (PAR), standardized as RFC 9126, hardens the OAuth 2.0 authorization flow by moving the authorization request off the browser front channel. Instead of encoding parameters into a redirect URL a user’s browser carries, the client pushes them directly to the authorization server’s PAR endpoint over an authenticated back channel and gets back a short-lived request_uri to reference at the authorization endpoint.
- Integrity and confidentiality - Request parameters can’t be inspected or tampered with in the browser or in logs, because they never travel there.
- A FAPI requirement - PAR is part of the Financial-grade API security profiles, so any ecosystem that mandates FAPI — open banking, open finance, CDR — inherits it as a baseline, not an option.
- Paired with strong client auth - It is typically deployed alongside
private_key_jwtclient authentication and mTLS-bound access tokens to complete a high-assurance authorization stack.
In regulated banking sectors, PAR is one of the concrete, machine-checkable signals that a provider ships genuine bank-grade auth rather than the query-string API keys that still dominate most of the API economy. When I read a bank’s authentication profile and see PAR alongside FAPI, OIDC, private_key_jwt, and mTLS, that is the mandate having produced real rigor at the hard part of the stack.
Referenced in API Evangelist papers
This standard shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this standard in the context of a real sector.
The State of Australian Banking APIs
PAR is part of the FAPI stack every CDR data-sharing surface requires.
