FAPI (Financial-grade API)
What it is
FAPI, the Financial-grade API profile from the OpenID Foundation, is a tightened security profile layered on OAuth 2.0 and OpenID Connect. It exists because plain OAuth, while flexible, leaves choices that are unsafe for high-value APIs like banking and payments. FAPI removes that ambiguity and mandates the strong options.
How it works
FAPI raises the bar with requirements such as:
- Sender-constrained tokens (mutual TLS or DPoP) so a stolen token cannot be replayed by another client.
- Pushed Authorization Requests (PAR) so request parameters are sent over a back channel and cannot be tampered with.
- Strong client authentication and signed request objects.
Status
FAPI 1.0 is widely deployed in open banking regimes (UK, Brazil, Australia and others). FAPI 2.0 simplifies and strengthens the profile and is the current target for new implementations.
When to use it
When you expose APIs that move money or highly sensitive data, or when a regulator or open-banking scheme requires it. For ordinary consumer login, standard OIDC is sufficient.
Pitfalls
- FAPI is demanding to implement correctly; use a certified provider rather than building it yourself.
- Conformance matters: look for OpenID Foundation FAPI certification on any platform you rely on.
Related
Glossary: FAPI, PAR, DPoP. Standards: OAuth 2.0, OpenID Connect.
Related on Start with Identity
- GlossaryAPI Key
A static secret string used to authenticate an application or caller to an API. Simple but weak: it does not expire on its own, is easy to leak, and should be v
- GuideAPI Key Rotation Automation Guide
A practical guide to automating API key rotation with zero downtime, covering rotation strategies, secrets management integration, dual-key patterns, monitoring
- RankingBest CIAM for Fintech & Financial Services: Top 5
The best CIAM platforms for fintech and financial services in 2026: Auth0, Ping Identity, Transmit Security, ForgeRock, and SAP Customer Data Cloud. Ranked for
- RankingBest Identity Tools for Financial Services: Top 5
The top 5 identity tools for financial services (Microsoft Entra ID, CyberArk, SailPoint, Okta, Silverfort), chosen for regulation, privileged risk, and threat
- Industryfinancial-services
How identity works in financial services: strong customer authentication and fraud, privileged access and governance under PSD2, GLBA, PCI DSS, and DORA, with t
- CVEIvanti EPMM (MobileIron Core) unauthenticated API access
Every supported EPMM 11.8-11.10 release exposed restricted API functionality with no login. Attackers pulled user and device data, then chained CVE-2023-35081.