Support for Pushed Authorization Requests (PAR) and JWT Secured Authorization Request (JAR)

The issue is about adding PAR and JAR support to the auth0_flutter SDK's web authentication flow. Start by examining the webAuth() method implementation, likely in the main SDK directory. Understand how the authorize URL is currently constructed and where PKCE and state are generated. Review the Auth0 PAR endpoint documentation and the linked RFCs to understand the required POST request and request_uri handling. 'Done' means the SDK can optionally make a PAR request or accept a pre-fetched request_uri or signed request object before initiating the browser flow.

Checklist

• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Describe the problem you'd like to have solved

Many enterprise, financial, and high-security mobile applications require compliance with security profiles such as FAPI (Financial-grade API) 1.0 / 2.0 or strict OAuth 2.0 recommendations. Two critical standards in these profiles are:

Pushed Authorization Requests (PAR - RFC 9126): Prevents parameter tampering, leaking sensitive scope/claims data in GET query parameters, and browser history leakage by pushing authorization parameters out-of-band via a POST request prior to redirection.

JWT Secured Authorization Request (JAR - RFC 9101): Allows signing authorization request parameters using a JWT (Request Object) to ensure request integrity and authenticity.

Currently, auth0_flutter initiates web authorization by generating full standard authorize URL queries. Because the SDK manages PKCE code verifiers, state generation, and browser redirection internally, applications cannot cleanly make a PAR request out-of-band to get a request_uri and pass it into auth0_flutter.webAuth().

Describe the ideal solution

Native support within auth0_flutter to support PAR and JAR workflows seamlessly during Web Auth authentication flows.

Ideally, this could be configured globally during SDK initialization or per-login attempt via webAuth() options:

// Example API proposal

// Option A: Explicit parameter/flag enabling PAR
await auth0.webAuth().login(
  usePar: true, // Automates POST to /oauth/par prior to opening browser session
  scopes: {'openid', 'profile', 'email', 'custom_scope'},
);

// Option B: Support passing a pre-fetched request_uri or request parameter (JAR)
await auth0.webAuth().login(
  parameters: {
    'request_uri': 'urn:ietf:params:oauth:request_uri:12345...',
    // or signed request object (JAR)
    'request': 'eyJhbGciOiJSUzI1NiIs...' 
  },
);

Alternatives and current workarounds

• Manual PAR implementation via custom HTTP client: Attempting to make the /oauth/par POST call manually prior to calling webAuth(). However, auth0_flutter generates its own state/PKCE challenge internally when building the authorize URL, leading to mismatched parameters or requiring custom flutter_web_auth_2 workarounds that bypass auth0_flutter entirely.

• Custom redirect URI parameters: Passing additional query parameters via parameters: {}, which does not solve the necessity of making the initial POST endpoint call or signing the request object out-of-band.

Additional context

• RFC 9126 (OAuth 2.0 Pushed Authorization Requests): https://datatracker.ietf.org/doc/html/rfc9126

• RFC 9101 (The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)): https://datatracker.ietf.org/doc/html/rfc9101

• Auth0 PAR Support: Auth0 supports PAR on tenant endpoints (/oauth/par). Bringing this capability to the native Flutter SDK enables Flutter developers to build FAPI-compliant mobile applications without needing native platform bridges or custom OAuth libraries.