/par

Request

Identity Engine

The pushed authorization request endpoint (/par) promotes OAuth security by allowing the authorization server to authenticate the client before any user interaction happens. The increased confidence in the client's identity during the authorization process means the authorization server can refuse illegitimate requests much earlier in the process. This process prevents attempts to spoof clients or otherwise tamper with or misuse an authorization request and provides a simple way to make a confidential and integrity-protected request.

The /par endpoint allows an OAuth 2.0 client to push the payload of an authorization request directly to the authorization server. The authorization server provides a request URI value in the response. The request URI is a reference to the authorization request payload data in a subsequent call to the /authorize endpoint through a user agent.

Bodyapplication/json

client_idstring

Obtained during either manual client registration or through the Dynamic Client Registration API

code_challengestring

A challenge for PKCE. The challenge is verified in the access token request.

code_challenge_methodstring

Method used to derive the code challenge for PKCE

displaystring

The display parameter to be passed to the external identity provider when performing social login

idpstring

An Okta extension to the OpenID specification. The ID of the identity provider to use if there's no Okta session.

idp_scopestring

An Okta extension to the OpenID specification. A space-delimited list of scopes to be provided to the external identity provider when performing social login. These scopes are used in addition to the scopes already configured for the identity provider.

login_hintstring

A username to pre-populate if prompting for authentication

max_ageinteger

Allowable elapsed time, in seconds, since the last time the end user was actively authenticated by Okta

noncestring

A value that's returned in the ID token. It's used to mitigate replay attacks. The value is required for implicit and hybrid flows, but optional for auth code flows. See OIDC Specs.

promptstring

If you don't specify the prompt parameter, the standard behavior occurs:

If an Okta session already exists and meets the assurance requirements of the app, the user is silently authenticated. Otherwise, Okta prompts the user to authenticate.
If scopes are requested that require consent and consent isn't yet given by the authenticated user, Okta prompts the user to give consent.

redirect_uristring

Callback location where you want the authorization code or tokens sent to. It must match the value preregistered in Okta during client registration.

requeststring

Used to push a Request Object JWT to the authorization server

response_modestring

How Okta should return the authorization response. If id_token or token is specified in the response_type, then query isn't allowed as a response mode. Defaults to fragment in implicit and hybrid flows.

The Referrer-Policy header is automatically included in the response when either the fragment or query parameter values are used. The header is set to Referrer-Policy: no-referrer.

response_typestring

Any combination of code, token, and id_token. The combination determines the flow.

scopestring

A space-delimited string of scopes requested

sessionTokenstring

Okta one-time session token. This is an Okta extension to the OpenID specification. The sessionToken allows an API-based user sign-in flow.

statestring

A value returned with the token. The client app can use it to remember the state of its interaction with the end user at the time of the authentication call. It can contain alphanumeric, comma, period, underscore, and hyphen characters.

POST

/oauth2/v1/par

curl -i -X POST \
  https://okta-subdomain.pixtulate.com/oauth2/v1/par \
  -H 'Content-Type: application/json' \
  -d '{
    "client_id": "string",
    "code_challenge": "string",
    "code_challenge_method": "string",
    "display": "string",
    "idp": "string",
    "idp_scope": "string",
    "login_hint": "string",
    "max_age": 0,
    "nonce": "string",
    "prompt": "string",
    "redirect_uri": "string",
    "request": "string",
    "response_mode": "string",
    "response_type": "string",
    "scope": "string",
    "sessionToken": "string",
    "state": "string"
  }'

Responses

Success

Bodyapplication/json

expires_ininteger

Number of seconds until the request_uri expires

request_uristring

Location where the authorization request payload data is referenced in authorization requests to the /authorize endpoint

Response

{
  "request_uri": "urn:okta:Y1hIQ3ZqYjFodEZMOVJ3TUF4ZHRPZjJuNFZRV2ZWQ044MmFoX2VIT2oyNDo",
  "expires_in": 3600
}