FAPI 2.0 (Financial-grade API) is a security profile built on OAuth 2.0 and OpenID Connect that hardens them for high-stakes, high-assurance use cases (most notably open banking and financial APIs) by specifying stricter requirements than baseline OAuth/OIDC. It’s the standard that lets banks and fintechs expose APIs for third-party access with the security financial data demands.

Baseline OAuth and OIDC are flexible, which means they can be implemented with varying (sometimes insufficient) security. FAPI tightens the profile specifically for financial-grade contexts where the consequences of a flaw are severe.

What FAPI 2.0 adds

FAPI 2.0 mandates the stronger security options that baseline OAuth leaves optional, including robust client authentication, sender-constrained tokens (so a stolen token can’t be used by another party), strict redirect and request handling (often via signed request objects and PAR: pushed authorization requests), and PKCE. The result is a hardened, interoperable profile that raises the security floor for API access to a level appropriate for banking.

Why FAPI matters for open banking

Open banking and open finance require banks to expose customer data and payment initiation to authorized third parties via APIs, a powerful capability that’s also a serious security responsibility. FAPI is the security standard that makes this safe and interoperable: third parties and banks that both conform to FAPI can integrate with confidence that the security bar is met. Regulatory open-banking frameworks around the world reference or align with FAPI for exactly this reason.

FAPI as a trust signal

Because FAPI conformance is rigorous and independently certifiable, being FAPI 2.0 certified is a meaningful trust and compliance signal for an identity or open-banking platform. Transmit Security is FAPI 2.0 certified, which matters for financial institutions that need their identity and API-access layer to meet the security bar open banking requires. For buyers evaluating platforms for financial-grade API scenarios, FAPI conformance is a concrete, verifiable indicator rather than a marketing claim.

Frequently asked questions

What is FAPI 2.0?

A financial-grade security profile on top of OAuth 2.0 and OpenID Connect that hardens them for high-assurance use like open banking.

Why is FAPI needed?

Baseline OAuth/OIDC are flexible and can be implemented insecurely; FAPI mandates the stronger options financial data demands.

What does FAPI add over standard OAuth?

Stronger client authentication, sender-constrained tokens, strict request handling (PAR, signed requests), and PKCE.

Why does FAPI certification matter?

It’s an independently verifiable signal that a platform meets the security bar required for open banking and financial APIs.

Related: Open Banking · OAuth 2.0 · OpenID Connect (OIDC) · PSD2 · API Security