FAPI (Financial-grade API)
What it is
FAPI, the Financial-grade API profile from the OpenID Foundation, is a tightened security profile layered on OAuth 2.0 and OpenID Connect. It exists because plain OAuth, while flexible, leaves choices that are unsafe for high-value APIs like banking and payments. FAPI removes that ambiguity and mandates the strong options.
How it works
FAPI raises the bar with requirements such as:
- Sender-constrained tokens (mutual TLS or DPoP) so a stolen token cannot be replayed by another client.
- Pushed Authorization Requests (PAR) so request parameters are sent over a back channel and cannot be tampered with.
- Strong client authentication and signed request objects.
Status
FAPI 1.0 is widely deployed in open banking regimes (UK, Brazil, Australia and others). FAPI 2.0 simplifies and strengthens the profile and is the current target for new implementations.
When to use it
When you expose APIs that move money or highly sensitive data, or when a regulator or open-banking scheme requires it. For ordinary consumer login, standard OIDC is sufficient.
Pitfalls
- FAPI is demanding to implement correctly; use a certified provider rather than building it yourself.
- Conformance matters: look for OpenID Foundation FAPI certification on any platform you rely on.
Related
Glossary: FAPI, PAR, DPoP. Standards: OAuth 2.0, OpenID Connect.
Who wrote it
FAPI came out of the OpenID Foundation working group with Torsten Lodderstedt, and Daniel Fett led its formal security analysis. Nat Sakimura chairs the OpenID Foundation. More in the experts directory.
Related on Start with Identity
- GlossaryAPI Key
A static secret string used to authenticate an application or caller to an API. Simple but weak: it does not expire on its own, is easy to leak, and should be v
- GuideAPI Key Rotation Automation Guide
A practical guide to automating API key rotation with zero downtime, covering rotation strategies, secrets management integration, dual-key patterns, monitoring
- GlossaryAuthZEN (Authorization API)
AuthZEN is the OpenID Foundation working group, and the [Authorization API 1.0](https://openid.net/specs/authorization-api-1_0-final.html) specification it prod
- RankingBest CIAM for Fintech & Financial Services: Top 5
The best CIAM platforms for fintech and financial services in 2026: Auth0, Ping Identity, Transmit Security, ForgeRock, and SAP Customer Data Cloud. Ranked for
- RankingBest Identity Tools for Financial Services: Top 5
The top 5 identity tools for financial services (Microsoft Entra ID, CyberArk, now Idira, SailPoint, Okta, Silverfort), chosen for regulation, privileged risk,
- CVECisco ISE API authentication bypass, exploited on the network access control plane
An API endpoint on Cisco Identity Services Engine skipped authentication, letting an unauthenticated attacker past the admin interface and, per Cisco, to root.