enablePushedAuthorizationRequests

Enables Pushed Authorization Requests (PAR) for browser-based authorization flows.

Disabled by default. When enabled, supported flows use PAR whenever the discovered authorization server metadata advertises a pushed_authorization_request_endpoint — this applies to the org authorization server as well as custom ones; it is not gated on which kind of server is configured. Independently of this setting, a server that advertises require_pushed_authorization_requests always uses PAR.