Function oauth_par 

pub(crate) async fn oauth_par(
    __arg0: State<AppState>,
    peer: Peer,
    headers: HeaderMap,
    __arg3: Form<OAuthParForm>,
) -> Response

POST /oauth/par

The one place a sign-in is judged, and the earliest point a client is known; see crate::oauth::par’s doc for the two inputs that reach the verdict, and crate::oauth::decision for the record they are written into. login_hint is resolved through this layer’s own Registry — the layer that holds one — and a hint naming no account on this deployment gets the same 201 a real one does; see crate::oauth::par::push_for_unresolved_hint for what it does not get.

Unauthenticated, and bounded per caller address by crate::oauth::OAuthState::par_rate_limiter before any of that happens. Its DPoP proof is checked next; see checked_proof.