---
title: Securing OIDC sign-on with Pushed Authorization Requests
description: PingOne PingOne Advanced Identity Cloud PingAM Android iOS JavaScript
component: orchsdks
page_id: orchsdks:oidc:use-cases/par/index
canonical_url: https://developer.pingidentity.com/orchsdks/oidc/use-cases/par/index.html
llms_txt: https://developer.pingidentity.com/orchsdks/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: Thu, 19 Jun 2026 00:00:00 +0000
keywords: ["OAuth 2.0", "OpenID Connect", "Pushed Authorization Requests", "PAR", "RFC 9126", "SDK", "Android", "iOS", "JavaScript"]
section_ids:
  get_started: Get Started
---

# Securing OIDC sign-on with Pushed Authorization Requests

[icon: circle-check, set=far]PingOne [icon: circle-check, set=far]PingOne Advanced Identity Cloud [icon: circle-check, set=far]PingAM [icon: android, set=fab]Android [icon: apple, set=fab]iOS [icon: js, set=fab]JavaScript

The Orchestration SDK implements [Pushed Authorization Requests (PAR, RFC 9126)](https://datatracker.ietf.org/doc/html/rfc9126), an OAuth 2.0 extension that improves the security of the OIDC login flows.

In a standard OIDC redirect flow, authorization parameters such as `client_id`, `redirect_uri`, `scope`, and `state` are sent as query parameters in the browser's address bar when redirecting to the authorization server.

PAR moves these parameters to a direct, server-side `POST` request to the authorization server's `/par` endpoint *before* the browser redirect occurs.

The server returns a short-lived `request_uri` that acts as a reference to the stored parameters, and the browser is redirected to the `/authorize` endpoint using only that opaque reference.

Figure 1. Summary of the PAR flow

This approach provides several security benefits:

* **Reduced parameter exposure**

  Authorization parameters are no longer visible in browser history, proxy logs, or referrer headers.

* **Integrity protection**

  Parameters are submitted directly to the server over a backchannel connection before the redirect, so they cannot be tampered with in transit.

* **No URL length limits**

  Complex requests with many parameters, such as those using rich claims or `acr_values`, are no longer constrained by browser URL length limits.

## Get Started

[icon: android, set=fab, size=3x]

#### [Android](android.html)

Configure an Android app to use Pushed Authorization Requests for OIDC sign-on.

[icon: apple, set=fab, size=3x]

#### [iOS](ios.html)

Configure an iOS app to use Pushed Authorization Requests for OIDC sign-on.

[icon: js, set=fab, size=3x]

#### [JavaScript](javascript.html)

Configure a JavaScript app to use Pushed Authorization Requests for OIDC sign-on.