FAPI: the Financial-grade API Security Profiles
FAPI is the OpenID Foundation's hardened profile of OAuth 2.0 and OpenID Connect for APIs where a stolen token means a stolen payment. This guide covers FAPI 1.0 Baseline and Advanced, the FAPI 2.0 Security Profile and its attacker model, Message Signing and CIBA — what each one requires, the authorization-code flow message by message, which open-banking ecosystems mandate which profile, and a checklist for shipping it.
Who mandates which profile
FAPI is a toolkit; each ecosystem publishes its own security profile that pins the options (mTLS vs private_key_jwt, JARM vs hybrid, which claims a consent carries). The picture as of October 2026 — check the ecosystem's own specification before building, these move:
| Ecosystem | Profile | Notes |
|---|---|---|
| UK Open Banking (Open Banking Limited) | FAPI 1.0 Advanced + FAPI-CIBA | The Read/Write API Security Profile; JWS-signed payloads (x-jws-signature); eIDAS / OBIE certificates for mTLS. The first large FAPI ecosystem, and the one most conformance-suite bugs were found in. |
| Open Finance Brasil | FAPI 1.0 Advanced (FAPI-BR profiles), migrating to FAPI 2.0 | The largest FAPI ecosystem by participants and call volume; PAR and JARM are already mandatory in its 1.0-based profile, which shortens the path to the 2.0 Security Profile and Message Signing. |
| Australia CDR | FAPI 1.0 Advanced, FAPI 2.0 under consultation | Phased in from 2022 (PAR, JARM, private_key_jwt); the Data Standards Body has consulted on adopting the FAPI 2.0 Security Profile. Scope now includes energy and, from July 2026, non-bank lending. |
| ConnectID (Australia, Australian Payments Plus) | FAPI 2.0 | A bank-backed digital-identity exchange — an early example of FAPI 2.0 outside account APIs. |
| United States — FDX | FAPI 2.0 | Market-led standard recognised by the CFPB as a standard-setting body for the Section 1033 personal-financial-data rule (January 2025); FDX adopted FAPI 2.0 as its security profile. The 1033 rule itself is being reconsidered in the courts and by the CFPB. |
| Saudi Arabia (SAMA Open Banking) | FAPI 1.0 Advanced | AIS live 2023, PIS following; UK-style profile with mTLS and JARM. |
| UAE (CBUAE Open Finance) | FAPI 2.0 | Among the first regulator-mandated FAPI 2.0 ecosystems; launched with the Al Tareq / Nebras trust framework. |
| EU / EEA — PSD2 (Berlin Group, STET) | No FAPI mandate | PSD2 RTS requires eIDAS QWAC / QSealC identification, not a particular OAuth profile; many ASPSPs are FAPI-aligned in practice, and the Berlin Group's openFinance framework references FAPI 2.0. PSD3 / PSR do not change this. |
| Latin America (Chile, Colombia) | FAPI 2.0 expected | Chile's Fintech-law open-finance system and Colombia's regulation point at FAPI 2.0 from the start rather than 1.0. |
Pattern: ecosystems that launched before 2025 run FAPI 1.0 Advanced and are planning a 1.0 → 2.0 transition with a dual-support period; ecosystems launching now start on FAPI 2.0.
Certification
"We implement FAPI" is cheap to say and historically often wrong — early open-banking rollouts found implementations failing basic checks. The OpenID Foundation's certification programme fixes this: an open-source conformance suite runs hundreds of positive and negative test cases against an authorization server or client, and the vendor self-certifies the passing results, which are published. Most ecosystems make a current certificate a condition of onboarding.
| Certification profile | Who | Variants |
|---|---|---|
| FAPI 1.0 Advanced | OpenID Providers and Relying Parties | mTLS or private_key_jwt × hybrid or JARM; plus the UK, Brazil, Australia, Saudi ecosystem profiles. |
| FAPI 2.0 Security Profile | Authorization servers and clients | mTLS or private_key_jwt client auth × mTLS or DPoP sender constraining; OpenID Connect optional. Final tests since July 2025. |
| FAPI 2.0 Message Signing | Authorization servers and clients | Signed requests (JAR), signed responses (JARM), signed introspection — each certifiable on its own. |
| FAPI-CIBA | OpenID Providers | Poll and ping modes. |
The conformance suite is also the best test harness you will get for free: point it at your sandbox during development, not only before submission. The Security Profile says as much — deployments should use certified implementations rather than code the profile from first principles.