Pushed authorization request with client attestation and PKCE

Requirement as recorded in the ProtocolSoup registry

A pushed authorization request is client-attestation authenticated, PKCE-bound, and represented by a short-lived request_uri bound to the exact client and redirect URI. An optional PAR DPoP binding is retained, while HAIP wallets may introduce DPoP at token redemption. Authorization Server Metadata advertises the enforced client-attestation authentication and signing algorithms.

Self-test verdict

Tests

• TestPushedAuthorizationRequestBindsAttestationDPoPAndCredentialDetails

  ./internal/protocols/oid4vci

  Pass
• TestAuthorizationServerMetadataAdvertisesAttestationWhenConfigured

  ./internal/protocols/oid4vci

  Pass

Implementation

• backend/internal/protocols/oid4vci/par.go
• backend/internal/protocols/oid4vci/authorization_server_metadata.go
• backend/internal/protocols/oidc/request_uri.go

Related requirements