OAuth 2.0 consent management is explored across three layers: scopes, Rich Authorization Requests (RAR), and Pushed Authorization Requests (PAR). Basic scopes work for common cases but are too coarse for regulated or transaction-specific flows. Auth0 lets you switch from grouped scope summaries to per-scope descriptions with a single API call. RAR (RFC 9396) adds an `authorization_details` parameter carrying structured, transaction-level data so users see exactly what they're approving — critical for financial services and healthcare. PAR (RFC 9126) solves the privacy problem RAR introduces by POSTing the full authorization payload server-to-server first, returning a short-lived reference URI for the browser redirect, keeping sensitive data out of URLs, logs, and browser history. Together these three mechanisms form a progression for building consent screens users can genuinely trust.
