enablePushedAuthorizationRequests

Enables Pushed Authorization Requests (PAR) for browser-based authorization flows.

Disabled by default; opt in explicitly. When enabled, PAR is used whenever the discovered authorization server metadata advertises a pushed_authorization_request_endpoint — this applies to the org authorization server as well as custom ones. Independently of this setting, a server that advertises require_pushed_authorization_requests always uses PAR.