OAuth: Should PAR request bodies be form-encoded or JSON?

[DavidBuchanan314]

The docs (https://atproto.com/specs/oauth) and rfc9126 say the request body should be form-encoded.

But, the current typescript client implementation sends JSON:

atproto/packages/oauth/oauth-client/src/oauth-server-agent.ts

Line 213 in 7b16a86

headers: { ...auth.headers, 'Content-Type': 'application/json' },

Which is correct?