# FAPI (Financial-grade API)

Source: https://startwithidentity.com/standards/fapi/
Last updated: 2026-06-16
License: content by Start with Identity. Cite the source URL.

---

## What it is

FAPI, the Financial-grade API profile from the OpenID Foundation, is a tightened security profile layered on [OAuth 2.0](https://startwithidentity.com/standards/oauth-2-0/) and [OpenID Connect](https://startwithidentity.com/standards/openid-connect/). It exists because plain OAuth, while flexible, leaves choices that are unsafe for high-value APIs like banking and payments. FAPI removes that ambiguity and mandates the strong options.

## How it works

FAPI raises the bar with requirements such as:

- **Sender-constrained tokens** (mutual TLS or [DPoP](https://startwithidentity.com/glossary/dpop/)) so a stolen token cannot be replayed by another client.
- **[Pushed Authorization Requests](https://startwithidentity.com/glossary/par/) (PAR)** so request parameters are sent over a back channel and cannot be tampered with.
- **Strong client authentication** and signed request objects.

## Status

FAPI 1.0 is widely deployed in open banking regimes (UK, Brazil, Australia and others). FAPI 2.0 simplifies and strengthens the profile and is the current target for new implementations.

## When to use it

When you expose APIs that move money or highly sensitive data, or when a regulator or open-banking scheme requires it. For ordinary consumer login, standard OIDC is sufficient.

## Pitfalls

- FAPI is demanding to implement correctly; use a certified provider rather than building it yourself.
- Conformance matters: look for OpenID Foundation FAPI certification on any platform you rely on.

## Related

Glossary: [FAPI](https://startwithidentity.com/glossary/fapi/), [PAR](https://startwithidentity.com/glossary/par/), [DPoP](https://startwithidentity.com/glossary/dpop/). Standards: [OAuth 2.0](https://startwithidentity.com/standards/oauth-2-0/), [OpenID Connect](https://startwithidentity.com/standards/openid-connect/).

## Who wrote it

FAPI came out of the OpenID Foundation working group with [Torsten Lodderstedt](https://startwithidentity.com/experts/torsten-lodderstedt/), and [Daniel Fett](https://startwithidentity.com/experts/daniel-fett/) led its formal security analysis. [Nat Sakimura](https://startwithidentity.com/experts/nat-sakimura/) chairs the OpenID Foundation. More in the [experts directory](https://startwithidentity.com/experts/).