FAPI
Financial-grade API. A hardened OAuth and OIDC security profile from the OpenID Foundation for high-risk APIs such as open banking, mandating stronger client authentication and request integrity.
FAPI is what OAuth looks like when the money is real: sender-constrained tokens, pushed authorization requests, strong client authentication, and signed request objects, all mandatory rather than optional. It became the de facto baseline for open banking worldwide, which means it is also the best available template for any high-value API even outside financial services. If you are securing payment initiation or account access, start from FAPI rather than from plain OAuth.
See also: FAPI standard, PAR, mTLS, PSD2
Related on Start with Identity
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- GlossaryDPoP
Demonstrating Proof of Possession (RFC 9449). Binds an access token to a specific key held by the client, so a stolen bearer token cannot be replayed. Important
- GlossaryJWKS
JSON Web Key Set. A published set of public keys an issuer uses to sign tokens, letting relying parties verify JWT signatures and handle key rotation. The JWKS
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEKeycloak session hijack via prompt=login re-authentication
Starting a new authentication with prompt=login could hijack an existing Keycloak session. The re-auth step did not bind to the original user tightly enough. Pa