Function createPushedAuthorizationRequest

createPushedAuthorizationRequest(
    options: CreatePushedAuthorizationRequestOptionsSigned<
        CreatePushedAuthorizationRequestOptions,
    >,
): Promise<
    {
        client_id: string;
        pkceCodeVerifier: string;
        request: string;
        [key: string]: unknown;
    },
>
Creates a Pushed Authorization Request (PAR) for OAuth 2.0 authorization flows.

This function conditionally creates signed JWT-Secured Authorization Requests (JAR) based on the Authorization Server's require_signed_request_object metadata parameter as defined in RFC 9101. The signing behavior enables compliance with both OAuth 2.0 PAR (RFC 9126) and IT-Wallet v1.3.3 specifications.

Conditional JAR Signing:
- When require_signed_request_object is true: Creates a signed JAR
- When require_signed_request_object is false: Creates an unsigned authorization request
- When metadata not provided: Defaults to unsigned (permissive)
Security Note: Disabling JAR signing (setting require_signed_request_object: false) should only be done when the Authorization Server explicitly supports and allows unsigned requests. Signed requests provide protection against request tampering and replay attacks.
Parameters
- options: CreatePushedAuthorizationRequestOptionsSigned<
  CreatePushedAuthorizationRequestOptions,
  >
  Configuration for creating the PAR
  - audience
    The identifier of the Credential Issuer (used as JWT aud claim)
  - authorization_details
    Fine-grained authorization requirements using JSON data structures
  - authorizationServerMetadata
    Authorization Server metadata for conditional JAR signing
  - authorizationServerMetadata.require_signed_request_object
    When true, creates a signed JAR. When false, creates an unsigned authorization request. Defaults to false if not provided (permissive).
  - callbacks
    Cryptographic callback functions (generateRandom, hash, signJwt)
  - clientId
    Thumbprint of the jwk value in the cnf parameter inside Wallet Attestation
  - codeChallengeMethodsSupported
    Supported code challenge methods from Authorization Server
  - dpop
    DPoP signer options (alg, publicJwk.kid). Required when JAR signing is enabled; omitted for unsigned requests
  - jti
    Optional JWT ID for PAR (auto-generated if not provided)
  - pkceCodeVerifier
    Optional PKCE code verifier (auto-generated if not provided)
  - redirectUri
    Redirect URI for the authorization response
  - config
    Italian Wallet specification version used to build the request shape
  - responseMode
    Response mode (v1.0 only, must be supported by Credential Issuer)
  - scope
    OAuth 2.0 scope to request
  - state
    Optional state parameter (auto-generated if not provided)
  - expiresAt
    Optional JWT expiration time (defaults to 1 hour from issuedAt)
  - issuedAt
    Optional JWT issued at time (defaults to current time)
Returns Promise<
    {
        client_id: string;
        pkceCodeVerifier: string;
        request: string;
        [key: string]: unknown;
    },
>
A promise resolving to either:
- PushedAuthorizationRequestSigned when JAR signing is required (contains request JWT)
- version-specific unsigned PAR when JAR signing is not required (contains authorizationRequest object)
Throws
If DPoP signer is missing required properties (alg, publicJwk.kid)

Throws
If PKCE code challenge method is not supported

Throws
If authorization request parameters fail validation
Example
```
// Example 1: Create signed PAR for IT-Wallet v1.0 (explicit)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
});

const signedPar = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  dpop: { signer: { alg: 'ES256', publicJwk: { kid: 'key-1' } } },
  redirectUri: 'https://wallet.example.com/callback',
  responseMode: 'form_post.jwt',
  scope: 'openid',
  authorizationServerMetadata: {
    require_signed_request_object: true  // Creates signed JAR
  }
});
// signedPar.request contains the signed JWT
```
Example
```
// Example 2: Create unsigned PAR for IT-Wallet v1.3 (when Authorization Server allows it)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_3,
});

const unsignedPar = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  redirectUri: 'https://wallet.example.com/callback',
  scope: 'openid',
  authorizationServerMetadata: {
    require_signed_request_object: false  // Creates unsigned request — dpop not needed
  }
});
// unsignedPar.authorizationRequest contains the plain object
```
Example
```
// Example 3: Default behavior for IT-Wallet v1.0 (no metadata - unsigned)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
});

const par = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  redirectUri: 'https://wallet.example.com/callback',
  responseMode: 'form_post.jwt',
  scope: 'openid'
  // No authorizationServerMetadata — defaults to unsigned, dpop not needed
});
// par.authorizationRequest contains the plain object (permissive default)
```
See
- Defined in packages/oauth2/src/authorization-request/create-authorization-request.ts:263
createPushedAuthorizationRequest(
    options: CreatePushedAuthorizationRequestOptionsUnsigned<
        CreatePushedAuthorizationRequestOptionsV1_0,
    >,
): Promise<
    {
        authorizationRequest: {
            authorization_details?: (
                | { credential_configuration_id: string; type: "openid_credential" }
                | {
                    challenge_method: "mrtd+ias";
                    challenge_redirect_uri: string;
                    idphinting: string;
                    type: "it_l2+document_proof";
                }
            )[];
            client_id: string;
            code_challenge: string;
            code_challenge_method: string;
            issuer_state?: string;
            jti: string;
            redirect_uri: string;
            response_mode: string;
            response_type: string;
            scope?: string;
            state: string;
            [key: string]: unknown;
        };
        client_id: string;
        pkceCodeVerifier: string;
        [key: string]: unknown;
    },
>
Creates a Pushed Authorization Request (PAR) for OAuth 2.0 authorization flows.

This function conditionally creates signed JWT-Secured Authorization Requests (JAR) based on the Authorization Server's require_signed_request_object metadata parameter as defined in RFC 9101. The signing behavior enables compliance with both OAuth 2.0 PAR (RFC 9126) and IT-Wallet v1.3.3 specifications.

Conditional JAR Signing:
- When require_signed_request_object is true: Creates a signed JAR
- When require_signed_request_object is false: Creates an unsigned authorization request
- When metadata not provided: Defaults to unsigned (permissive)
Security Note: Disabling JAR signing (setting require_signed_request_object: false) should only be done when the Authorization Server explicitly supports and allows unsigned requests. Signed requests provide protection against request tampering and replay attacks.
Parameters
- options: CreatePushedAuthorizationRequestOptionsUnsigned<
  CreatePushedAuthorizationRequestOptionsV1_0,
  >
  Configuration for creating the PAR
  - audience
    The identifier of the Credential Issuer (used as JWT aud claim)
  - authorization_details
    Fine-grained authorization requirements using JSON data structures
  - authorizationServerMetadata
    Authorization Server metadata for conditional JAR signing
  - authorizationServerMetadata.require_signed_request_object
    When true, creates a signed JAR. When false, creates an unsigned authorization request. Defaults to false if not provided (permissive).
  - callbacks
    Cryptographic callback functions (generateRandom, hash, signJwt)
  - clientId
    Thumbprint of the jwk value in the cnf parameter inside Wallet Attestation
  - codeChallengeMethodsSupported
    Supported code challenge methods from Authorization Server
  - dpop
    DPoP signer options (alg, publicJwk.kid). Required when JAR signing is enabled; omitted for unsigned requests
  - jti
    Optional JWT ID for PAR (auto-generated if not provided)
  - pkceCodeVerifier
    Optional PKCE code verifier (auto-generated if not provided)
  - redirectUri
    Redirect URI for the authorization response
  - config
    Italian Wallet specification version used to build the request shape
  - responseMode
    Response mode (v1.0 only, must be supported by Credential Issuer)
  - scope
    OAuth 2.0 scope to request
  - state
    Optional state parameter (auto-generated if not provided)
  - expiresAt
    Optional JWT expiration time (defaults to 1 hour from issuedAt)
  - issuedAt
    Optional JWT issued at time (defaults to current time)
Returns Promise<
    {
        authorizationRequest: {
            authorization_details?: (
                | { credential_configuration_id: string; type: "openid_credential" }
                | {
                    challenge_method: "mrtd+ias";
                    challenge_redirect_uri: string;
                    idphinting: string;
                    type: "it_l2+document_proof";
                }
            )[];
            client_id: string;
            code_challenge: string;
            code_challenge_method: string;
            issuer_state?: string;
            jti: string;
            redirect_uri: string;
            response_mode: string;
            response_type: string;
            scope?: string;
            state: string;
            [key: string]: unknown;
        };
        client_id: string;
        pkceCodeVerifier: string;
        [key: string]: unknown;
    },
>
A promise resolving to either:
- PushedAuthorizationRequestSigned when JAR signing is required (contains request JWT)
- version-specific unsigned PAR when JAR signing is not required (contains authorizationRequest object)
Throws
If DPoP signer is missing required properties (alg, publicJwk.kid)

Throws
If PKCE code challenge method is not supported

Throws
If authorization request parameters fail validation
Example
```
// Example 1: Create signed PAR for IT-Wallet v1.0 (explicit)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
});

const signedPar = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  dpop: { signer: { alg: 'ES256', publicJwk: { kid: 'key-1' } } },
  redirectUri: 'https://wallet.example.com/callback',
  responseMode: 'form_post.jwt',
  scope: 'openid',
  authorizationServerMetadata: {
    require_signed_request_object: true  // Creates signed JAR
  }
});
// signedPar.request contains the signed JWT
```
Example
```
// Example 2: Create unsigned PAR for IT-Wallet v1.3 (when Authorization Server allows it)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_3,
});

const unsignedPar = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  redirectUri: 'https://wallet.example.com/callback',
  scope: 'openid',
  authorizationServerMetadata: {
    require_signed_request_object: false  // Creates unsigned request — dpop not needed
  }
});
// unsignedPar.authorizationRequest contains the plain object
```
Example
```
// Example 3: Default behavior for IT-Wallet v1.0 (no metadata - unsigned)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
});

const par = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  redirectUri: 'https://wallet.example.com/callback',
  responseMode: 'form_post.jwt',
  scope: 'openid'
  // No authorizationServerMetadata — defaults to unsigned, dpop not needed
});
// par.authorizationRequest contains the plain object (permissive default)
```
See
- Defined in packages/oauth2/src/authorization-request/create-authorization-request.ts:267
createPushedAuthorizationRequest(
    options: CreatePushedAuthorizationRequestOptionsV1_0,
): Promise<
    | {
        client_id: string;
        pkceCodeVerifier: string;
        request: string;
        [key: string]: unknown;
    }
    | {
        authorizationRequest: {
            authorization_details?: (
                | { credential_configuration_id: string; type: "openid_credential" }
                | {
                    challenge_method: "mrtd+ias";
                    challenge_redirect_uri: string;
                    idphinting: string;
                    type: "it_l2+document_proof";
                }
            )[];
            client_id: string;
            code_challenge: string;
            code_challenge_method: string;
            issuer_state?: string;
            jti: string;
            redirect_uri: string;
            response_mode: string;
            response_type: string;
            scope?: string;
            state: string;
            [key: string]: unknown;
        };
        client_id: string;
        pkceCodeVerifier: string;
        [key: string]: unknown;
    },
>
Creates a Pushed Authorization Request (PAR) for OAuth 2.0 authorization flows.

This function conditionally creates signed JWT-Secured Authorization Requests (JAR) based on the Authorization Server's require_signed_request_object metadata parameter as defined in RFC 9101. The signing behavior enables compliance with both OAuth 2.0 PAR (RFC 9126) and IT-Wallet v1.3.3 specifications.

Conditional JAR Signing:
- When require_signed_request_object is true: Creates a signed JAR
- When require_signed_request_object is false: Creates an unsigned authorization request
- When metadata not provided: Defaults to unsigned (permissive)
Security Note: Disabling JAR signing (setting require_signed_request_object: false) should only be done when the Authorization Server explicitly supports and allows unsigned requests. Signed requests provide protection against request tampering and replay attacks.
Parameters
- options: CreatePushedAuthorizationRequestOptionsV1_0
  Configuration for creating the PAR
  - audience: string
    It MUST be set to the identifier of the Credential Issuer.
  - Optionalauthorization_details?: (
        | { credential_configuration_id: string; type: "openid_credential" }
        | {
            challenge_method: "mrtd+ias";
            challenge_redirect_uri: string;
            idphinting: string;
            type: "it_l2+document_proof";
        }
    )[]
    Allows clients to specify their fine-grained authorization requirements using the expressiveness of JSON data structures
  - OptionalauthorizationServerMetadata?: { require_signed_request_object?: boolean }
    Authorization Server metadata for conditional JAR signing. When require_signed_request_object is true, creates a signed JWT (JAR). When require_signed_request_object is false, creates an unsigned authorization request. Defaults to false (unsigned) if not provided.
    
    See
    RFC 9101 Section 10.5
  - callbacks: Pick<CallbackContext, "generateRandom" | "hash" | "signJwt">
    Callback context mostly for crypto related functionality
  - clientId: string
    MUST be set to the thumbprint of the jwk value in the cnf parameter inside the Wallet Attestation.
  - codeChallengeMethodsSupported: string[]
  - config: IoWalletSdkConfig<V1_0>
  - Optionaldpop?: RequestDpopOptions
    DPoP options. Required when require_signed_request_object is true (enforced at the type level via function overloads). Not used in the unsigned path and can be omitted.
  - OptionalexpiresAt?: Date
    Expiration time of the JWT. If not provided 1 hour will be added to the issuedAt
  - OptionalissuedAt?: Date
    Creation time of the JWT. If not provided the current date will be used
  - OptionalissuerState?: string
    Optional issuer state from the Credential Offer authorization_code grant. Serialized as issuer_state in the authorization request.
  - Optionaljti?: string
    jti parameter to use for PAR. If not provided a value will generated automatically
  - OptionalpkceCodeVerifier?: string
    Code verifier to use for pkce. If not provided a value will generated when pkce is supported
  - redirectUri: string
    Redirect uri to include in the authorization request
  - responseMode: string
    It MUST be one of the supported values (response_modes_supported) provided in the metadata of the Credential Issuer.
  - Optionalscope?: string
    Scope to request for the authorization request
  - Optionalstate?: string
    state parameter to use for PAR. If not provided a value will generated automatically
Returns Promise<
    | {
        client_id: string;
        pkceCodeVerifier: string;
        request: string;
        [key: string]: unknown;
    }
    | {
        authorizationRequest: {
            authorization_details?: (
                | { credential_configuration_id: string; type: "openid_credential" }
                | {
                    challenge_method: "mrtd+ias";
                    challenge_redirect_uri: string;
                    idphinting: string;
                    type: "it_l2+document_proof";
                }
            )[];
            client_id: string;
            code_challenge: string;
            code_challenge_method: string;
            issuer_state?: string;
            jti: string;
            redirect_uri: string;
            response_mode: string;
            response_type: string;
            scope?: string;
            state: string;
            [key: string]: unknown;
        };
        client_id: string;
        pkceCodeVerifier: string;
        [key: string]: unknown;
    },
>
A promise resolving to either:
- PushedAuthorizationRequestSigned when JAR signing is required (contains request JWT)
- version-specific unsigned PAR when JAR signing is not required (contains authorizationRequest object)
Throws
If DPoP signer is missing required properties (alg, publicJwk.kid)

Throws
If PKCE code challenge method is not supported

Throws
If authorization request parameters fail validation
Example
```
// Example 1: Create signed PAR for IT-Wallet v1.0 (explicit)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
});

const signedPar = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  dpop: { signer: { alg: 'ES256', publicJwk: { kid: 'key-1' } } },
  redirectUri: 'https://wallet.example.com/callback',
  responseMode: 'form_post.jwt',
  scope: 'openid',
  authorizationServerMetadata: {
    require_signed_request_object: true  // Creates signed JAR
  }
});
// signedPar.request contains the signed JWT
```
Example
```
// Example 2: Create unsigned PAR for IT-Wallet v1.3 (when Authorization Server allows it)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_3,
});

const unsignedPar = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  redirectUri: 'https://wallet.example.com/callback',
  scope: 'openid',
  authorizationServerMetadata: {
    require_signed_request_object: false  // Creates unsigned request — dpop not needed
  }
});
// unsignedPar.authorizationRequest contains the plain object
```
Example
```
// Example 3: Default behavior for IT-Wallet v1.0 (no metadata - unsigned)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
});

const par = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  redirectUri: 'https://wallet.example.com/callback',
  responseMode: 'form_post.jwt',
  scope: 'openid'
  // No authorizationServerMetadata — defaults to unsigned, dpop not needed
});
// par.authorizationRequest contains the plain object (permissive default)
```
See
- Defined in packages/oauth2/src/authorization-request/create-authorization-request.ts:271
createPushedAuthorizationRequest(
    options:
        | CreatePushedAuthorizationRequestOptionsUnsigned<
            CreatePushedAuthorizationRequestOptionsV1_3,
        >
        | CreatePushedAuthorizationRequestOptionsUnsigned<
            CreatePushedAuthorizationRequestOptionsV1_4,
        >,
): Promise<
    {
        authorizationRequest: {
            authorization_details?: (
                | { credential_configuration_id: string; type: "openid_credential" }
                | {
                    challenge_method: "mrtd+ias";
                    challenge_redirect_uri: string;
                    idphinting: string;
                    type: "it_l2+document_proof";
                }
            )[];
            client_id: string;
            code_challenge: string;
            code_challenge_method: string;
            issuer_state?: string;
            jti: string;
            redirect_uri: string;
            response_type: string;
            scope?: string;
            state: string;
            [key: string]: unknown;
        };
        client_id: string;
        pkceCodeVerifier: string;
        [key: string]: unknown;
    },
>
Creates a Pushed Authorization Request (PAR) for OAuth 2.0 authorization flows.

This function conditionally creates signed JWT-Secured Authorization Requests (JAR) based on the Authorization Server's require_signed_request_object metadata parameter as defined in RFC 9101. The signing behavior enables compliance with both OAuth 2.0 PAR (RFC 9126) and IT-Wallet v1.3.3 specifications.

Conditional JAR Signing:
- When require_signed_request_object is true: Creates a signed JAR
- When require_signed_request_object is false: Creates an unsigned authorization request
- When metadata not provided: Defaults to unsigned (permissive)
Security Note: Disabling JAR signing (setting require_signed_request_object: false) should only be done when the Authorization Server explicitly supports and allows unsigned requests. Signed requests provide protection against request tampering and replay attacks.
Parameters
- options:
      | CreatePushedAuthorizationRequestOptionsUnsigned<
          CreatePushedAuthorizationRequestOptionsV1_3,
      >
      | CreatePushedAuthorizationRequestOptionsUnsigned<
          CreatePushedAuthorizationRequestOptionsV1_4,
      >
  Configuration for creating the PAR
  - CreatePushedAuthorizationRequestOptionsUnsigned<
    CreatePushedAuthorizationRequestOptionsV1_3,
    >
    audience
    The identifier of the Credential Issuer (used as JWT aud claim)
    
    authorization_details
    Fine-grained authorization requirements using JSON data structures
    
    authorizationServerMetadata
    Authorization Server metadata for conditional JAR signing
    
    authorizationServerMetadata.require_signed_request_object
    When true, creates a signed JAR. When false, creates an unsigned authorization request. Defaults to false if not provided (permissive).
    
    callbacks
    Cryptographic callback functions (generateRandom, hash, signJwt)
    
    clientId
    Thumbprint of the jwk value in the cnf parameter inside Wallet Attestation
    
    codeChallengeMethodsSupported
    Supported code challenge methods from Authorization Server
    
    dpop
    DPoP signer options (alg, publicJwk.kid). Required when JAR signing is enabled; omitted for unsigned requests
    
    jti
    Optional JWT ID for PAR (auto-generated if not provided)
    
    pkceCodeVerifier
    Optional PKCE code verifier (auto-generated if not provided)
    
    redirectUri
    Redirect URI for the authorization response
    
    config
    Italian Wallet specification version used to build the request shape
    
    responseMode
    Response mode (v1.0 only, must be supported by Credential Issuer)
    
    scope
    OAuth 2.0 scope to request
    
    state
    Optional state parameter (auto-generated if not provided)
    
    expiresAt
    Optional JWT expiration time (defaults to 1 hour from issuedAt)
    
    issuedAt
    Optional JWT issued at time (defaults to current time)
  - CreatePushedAuthorizationRequestOptionsUnsigned<
    CreatePushedAuthorizationRequestOptionsV1_4,
    >
    audience
    The identifier of the Credential Issuer (used as JWT aud claim)
    
    authorization_details
    Fine-grained authorization requirements using JSON data structures
    
    authorizationServerMetadata
    Authorization Server metadata for conditional JAR signing
    
    authorizationServerMetadata.require_signed_request_object
    When true, creates a signed JAR. When false, creates an unsigned authorization request. Defaults to false if not provided (permissive).
    
    callbacks
    Cryptographic callback functions (generateRandom, hash, signJwt)
    
    clientId
    Thumbprint of the jwk value in the cnf parameter inside Wallet Attestation
    
    codeChallengeMethodsSupported
    Supported code challenge methods from Authorization Server
    
    dpop
    DPoP signer options (alg, publicJwk.kid). Required when JAR signing is enabled; omitted for unsigned requests
    
    jti
    Optional JWT ID for PAR (auto-generated if not provided)
    
    pkceCodeVerifier
    Optional PKCE code verifier (auto-generated if not provided)
    
    redirectUri
    Redirect URI for the authorization response
    
    config
    Italian Wallet specification version used to build the request shape
    
    responseMode
    Response mode (v1.0 only, must be supported by Credential Issuer)
    
    scope
    OAuth 2.0 scope to request
    
    state
    Optional state parameter (auto-generated if not provided)
    
    expiresAt
    Optional JWT expiration time (defaults to 1 hour from issuedAt)
    
    issuedAt
    Optional JWT issued at time (defaults to current time)
Returns Promise<
    {
        authorizationRequest: {
            authorization_details?: (
                | { credential_configuration_id: string; type: "openid_credential" }
                | {
                    challenge_method: "mrtd+ias";
                    challenge_redirect_uri: string;
                    idphinting: string;
                    type: "it_l2+document_proof";
                }
            )[];
            client_id: string;
            code_challenge: string;
            code_challenge_method: string;
            issuer_state?: string;
            jti: string;
            redirect_uri: string;
            response_type: string;
            scope?: string;
            state: string;
            [key: string]: unknown;
        };
        client_id: string;
        pkceCodeVerifier: string;
        [key: string]: unknown;
    },
>
A promise resolving to either:
- PushedAuthorizationRequestSigned when JAR signing is required (contains request JWT)
- version-specific unsigned PAR when JAR signing is not required (contains authorizationRequest object)
Throws
If DPoP signer is missing required properties (alg, publicJwk.kid)

Throws
If PKCE code challenge method is not supported

Throws
If authorization request parameters fail validation
Example
```
// Example 1: Create signed PAR for IT-Wallet v1.0 (explicit)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
});

const signedPar = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  dpop: { signer: { alg: 'ES256', publicJwk: { kid: 'key-1' } } },
  redirectUri: 'https://wallet.example.com/callback',
  responseMode: 'form_post.jwt',
  scope: 'openid',
  authorizationServerMetadata: {
    require_signed_request_object: true  // Creates signed JAR
  }
});
// signedPar.request contains the signed JWT
```
Example
```
// Example 2: Create unsigned PAR for IT-Wallet v1.3 (when Authorization Server allows it)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_3,
});

const unsignedPar = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  redirectUri: 'https://wallet.example.com/callback',
  scope: 'openid',
  authorizationServerMetadata: {
    require_signed_request_object: false  // Creates unsigned request — dpop not needed
  }
});
// unsignedPar.authorizationRequest contains the plain object
```
Example
```
// Example 3: Default behavior for IT-Wallet v1.0 (no metadata - unsigned)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
});

const par = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  redirectUri: 'https://wallet.example.com/callback',
  responseMode: 'form_post.jwt',
  scope: 'openid'
  // No authorizationServerMetadata — defaults to unsigned, dpop not needed
});
// par.authorizationRequest contains the plain object (permissive default)
```
See
- Defined in packages/oauth2/src/authorization-request/create-authorization-request.ts:277
createPushedAuthorizationRequest(
    options:
        | CreatePushedAuthorizationRequestOptionsV1_3
        | CreatePushedAuthorizationRequestOptionsV1_4,
): Promise<
    | {
        client_id: string;
        pkceCodeVerifier: string;
        request: string;
        [key: string]: unknown;
    }
    | {
        authorizationRequest: {
            authorization_details?: (
                | { credential_configuration_id: string; type: "openid_credential" }
                | {
                    challenge_method: "mrtd+ias";
                    challenge_redirect_uri: string;
                    idphinting: string;
                    type: "it_l2+document_proof";
                }
            )[];
            client_id: string;
            code_challenge: string;
            code_challenge_method: string;
            issuer_state?: string;
            jti: string;
            redirect_uri: string;
            response_type: string;
            scope?: string;
            state: string;
            [key: string]: unknown;
        };
        client_id: string;
        pkceCodeVerifier: string;
        [key: string]: unknown;
    },
>
Creates a Pushed Authorization Request (PAR) for OAuth 2.0 authorization flows.

This function conditionally creates signed JWT-Secured Authorization Requests (JAR) based on the Authorization Server's require_signed_request_object metadata parameter as defined in RFC 9101. The signing behavior enables compliance with both OAuth 2.0 PAR (RFC 9126) and IT-Wallet v1.3.3 specifications.

Conditional JAR Signing:
- When require_signed_request_object is true: Creates a signed JAR
- When require_signed_request_object is false: Creates an unsigned authorization request
- When metadata not provided: Defaults to unsigned (permissive)
Security Note: Disabling JAR signing (setting require_signed_request_object: false) should only be done when the Authorization Server explicitly supports and allows unsigned requests. Signed requests provide protection against request tampering and replay attacks.
Parameters
- options:
  | CreatePushedAuthorizationRequestOptionsV1_3
  | CreatePushedAuthorizationRequestOptionsV1_4
  Configuration for creating the PAR
Returns Promise<
    | {
        client_id: string;
        pkceCodeVerifier: string;
        request: string;
        [key: string]: unknown;
    }
    | {
        authorizationRequest: {
            authorization_details?: (
                | { credential_configuration_id: string; type: "openid_credential" }
                | {
                    challenge_method: "mrtd+ias";
                    challenge_redirect_uri: string;
                    idphinting: string;
                    type: "it_l2+document_proof";
                }
            )[];
            client_id: string;
            code_challenge: string;
            code_challenge_method: string;
            issuer_state?: string;
            jti: string;
            redirect_uri: string;
            response_type: string;
            scope?: string;
            state: string;
            [key: string]: unknown;
        };
        client_id: string;
        pkceCodeVerifier: string;
        [key: string]: unknown;
    },
>
A promise resolving to either:
- PushedAuthorizationRequestSigned when JAR signing is required (contains request JWT)
- version-specific unsigned PAR when JAR signing is not required (contains authorizationRequest object)
Throws
If DPoP signer is missing required properties (alg, publicJwk.kid)

Throws
If PKCE code challenge method is not supported

Throws
If authorization request parameters fail validation
Example
```
// Example 1: Create signed PAR for IT-Wallet v1.0 (explicit)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
});

const signedPar = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  dpop: { signer: { alg: 'ES256', publicJwk: { kid: 'key-1' } } },
  redirectUri: 'https://wallet.example.com/callback',
  responseMode: 'form_post.jwt',
  scope: 'openid',
  authorizationServerMetadata: {
    require_signed_request_object: true  // Creates signed JAR
  }
});
// signedPar.request contains the signed JWT
```
Example
```
// Example 2: Create unsigned PAR for IT-Wallet v1.3 (when Authorization Server allows it)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_3,
});

const unsignedPar = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  redirectUri: 'https://wallet.example.com/callback',
  scope: 'openid',
  authorizationServerMetadata: {
    require_signed_request_object: false  // Creates unsigned request — dpop not needed
  }
});
// unsignedPar.authorizationRequest contains the plain object
```
Example
```
// Example 3: Default behavior for IT-Wallet v1.0 (no metadata - unsigned)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
});

const par = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  redirectUri: 'https://wallet.example.com/callback',
  responseMode: 'form_post.jwt',
  scope: 'openid'
  // No authorizationServerMetadata — defaults to unsigned, dpop not needed
});
// par.authorizationRequest contains the plain object (permissive default)
```
See
- Defined in packages/oauth2/src/authorization-request/create-authorization-request.ts:283

createPushedAuthorizationRequest(
options: CreatePushedAuthorizationRequestOptions,
): Promise<PushedAuthorizationRequest>

Creates a Pushed Authorization Request (PAR) for OAuth 2.0 authorization flows.

This function conditionally creates signed JWT-Secured Authorization Requests (JAR) based on the Authorization Server's require_signed_request_object metadata parameter as defined in RFC 9101. The signing behavior enables compliance with both OAuth 2.0 PAR (RFC 9126) and IT-Wallet v1.3.3 specifications.

Conditional JAR Signing:

When require_signed_request_object is true: Creates a signed JAR
When require_signed_request_object is false: Creates an unsigned authorization request
When metadata not provided: Defaults to unsigned (permissive)

Security Note: Disabling JAR signing (setting require_signed_request_object: false) should only be done when the Authorization Server explicitly supports and allows unsigned requests. Signed requests provide protection against request tampering and replay attacks.

Parameters

options: CreatePushedAuthorizationRequestOptions
Configuration for creating the PAR

Returns Promise<PushedAuthorizationRequest>

A promise resolving to either:

PushedAuthorizationRequestSigned when JAR signing is required (contains request JWT)
version-specific unsigned PAR when JAR signing is not required (contains authorizationRequest object)

Throws

If DPoP signer is missing required properties (alg, publicJwk.kid)

Throws

If PKCE code challenge method is not supported

Throws

If authorization request parameters fail validation

Example

// Example 1: Create signed PAR for IT-Wallet v1.0 (explicit)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
});

const signedPar = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  dpop: { signer: { alg: 'ES256', publicJwk: { kid: 'key-1' } } },
  redirectUri: 'https://wallet.example.com/callback',
  responseMode: 'form_post.jwt',
  scope: 'openid',
  authorizationServerMetadata: {
    require_signed_request_object: true  // Creates signed JAR
  }
});
// signedPar.request contains the signed JWT

Example

// Example 2: Create unsigned PAR for IT-Wallet v1.3 (when Authorization Server allows it)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_3,
});

const unsignedPar = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  redirectUri: 'https://wallet.example.com/callback',
  scope: 'openid',
  authorizationServerMetadata: {
    require_signed_request_object: false  // Creates unsigned request — dpop not needed
  }
});
// unsignedPar.authorizationRequest contains the plain object

Example

// Example 3: Default behavior for IT-Wallet v1.0 (no metadata - unsigned)
const config = new IoWalletSdkConfig({
  itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
});

const par = await createPushedAuthorizationRequest({
  audience: 'https://issuer.example.com',
  callbacks: { generateRandom, hash, signJwt },
  clientId: 'wallet_client_thumbprint',
  codeChallengeMethodsSupported: ['S256'],
  config,
  redirectUri: 'https://wallet.example.com/callback',
  responseMode: 'form_post.jwt',
  scope: 'openid'
  // No authorizationServerMetadata — defaults to unsigned, dpop not needed
});
// par.authorizationRequest contains the plain object (permissive default)

Function createPushedAuthorizationRequest

Parameters

audience

authorization_details

authorizationServerMetadata

authorizationServerMetadata.require_signed_request_object

callbacks

clientId

codeChallengeMethodsSupported

dpop

jti

pkceCodeVerifier

redirectUri

config

responseMode

scope

state

expiresAt

issuedAt

Returns Promise< { client_id: string; pkceCodeVerifier: string; request: string; [key: string]: unknown; },>

Throws

Throws

Throws

Example

Example

Example

See

Parameters

audience

authorization_details

authorizationServerMetadata

authorizationServerMetadata.require_signed_request_object

callbacks

clientId

codeChallengeMethodsSupported

dpop

jti

pkceCodeVerifier

redirectUri

config

responseMode

scope

state

expiresAt

issuedAt

Throws

Throws

Throws

Example

Example

Example

See

Parameters

audience: string

Optionalauthorization_details?: ( | { credential_configuration_id: string; type: "openid_credential" } | { challenge_method: "mrtd+ias"; challenge_redirect_uri: string; idphinting: string; type: "it_l2+document_proof"; })[]

OptionalauthorizationServerMetadata?: { require_signed_request_object?: boolean }

See

callbacks: Pick<CallbackContext, "generateRandom" | "hash" | "signJwt">

clientId: string

codeChallengeMethodsSupported: string[]

config: IoWalletSdkConfig<V1_0>

Optionaldpop?: RequestDpopOptions

OptionalexpiresAt?: Date

OptionalissuedAt?: Date

OptionalissuerState?: string

Optionaljti?: string

OptionalpkceCodeVerifier?: string

redirectUri: string

responseMode: string

Optionalscope?: string

Optionalstate?: string

Throws

Throws

Throws

Example

Example

Example

See

Parameters

audience

Returns Promise<
{
client_id: string;
pkceCodeVerifier: string;
request: string;
[key: string]: unknown;
},
>

`Optional`authorization_details?: (
| { credential_configuration_id: string; type: "openid_credential" }
| {
challenge_method: "mrtd+ias";
challenge_redirect_uri: string;
idphinting: string;
type: "it_l2+document_proof";
}
)[]

`Optional`authorizationServerMetadata?: { require_signed_request_object?: boolean }

`Optional`dpop?: RequestDpopOptions

`Optional`expiresAt?: Date

`Optional`issuedAt?: Date

`Optional`issuerState?: string

`Optional`jti?: string

`Optional`pkceCodeVerifier?: string

`Optional`scope?: string

`Optional`state?: string