Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

I am very confused about the authorize endpoint  `audience` parameter. I don't see it listed anywhere in the OpenId Connect spec and it seems like it is required to populate the  `requested_access_token_audience` field during the acceptConsent stage. Is this parameter unique to Ory hydra?

So from my experience many OAuth 2.0 Authorization Servers implement this even though it's not a documented spec. Why? Well it seems like the spec lacks a means to narrow the token down to a specific set of audiences but that's a very compelling security desire, similar to scope.  As to your other questions I can't say.

I have seen some auth servers just implicitly grant all audiences, have an option to implicitly grant them for a specific client, and have seen some that grant no audiences i.e. explicitly granted only.

Okay so it's implementation specific. Thanks!