What is FAPI? Financial-Grade API Explained

FAPI is the OpenID Foundation’s security profile for OAuth 2.0 and OpenID Connect, purpose-built for APIs that enable access to financial accounts to ensure the security model is “bank grade”, for example to access sensitive financial data, or to initiate transactions . In other words, it takes the two protocols and removes the insecure choices. What remains is a tighter, auditable configuration that regulators and banks can rely on.

Banks, regulators, TPPs, and system integrators use FAPI across open banking, open finance, and payments ecosystems. It is a profile, not a new protocol: it tightens OAuth 2.0 and OpenID Connect defaults rather than replacing them.

This blog provides an overview of what FAPI means within financial services and how it’s used for increased security and reliability.

What does FAPI stand for?

FAPI stands for Financial-grade Application Programming Interface (API).

The term was coined and authored by the OpenID Foundation FAPI Working Group, and FAPI 1.0 was formally branded Financial-grade API initially. The financial framing was dropped for FAPI 2.0 to signal broader applicability beyond the banking sector, but market usage still reads the acronym as Financial-grade API and applies it to the same body of specifications.

The OpenID Foundation FAPI Working Group continues to publish the specifications, operate the conformance test suite, and coordinate with regulators and standards bodies globally.

What FAPI is used for

FAPI was designed for environments where API access carries direct financial or legal consequences. In practice, that means:

• Open banking ecosystems where TPPs access bank account data or initiate payments on behalf of customers, such as UK Open Banking , Brazil’s Open Finance (BCB), Australia’s Consumer Data Right (ACCC CDR), Saudi Arabia’s SAMA Open Banking framework, the UAE’s Open Finance Framework and Bahrain’s Open Banking Framework (CBB OBF).
• Open finance frameworks that extend into pensions, insurance, and investments.
• Payment APIs where transaction integrity and non-repudiation are required.
• Sectors outside finance are now adopting FAPI 2.0’s broadened scope: healthcare, government identity, and regulated B2B data sharing.

The Open Finance Tracker is the live reference for which markets mandate FAPI versus which recommend or reference it.

How FAPI works

FAPI is a profile of OAuth 2.0 and OpenID Connect, not a separate protocol. It mandates a known-secure subset of OAuth/OIDC options for high-stakes contexts, removing the optionality that creates attack surface in standard deployments.

The core mechanisms FAPI requires:

• Strong client authentication: mTLS or private_key_jwt. Client secrets in the request body are not permitted.
• Sender-constrained tokens: mTLS-bound tokens or DPoP, so a stolen token cannot be replayed by a different client.
• PKCE on every authorisation code flow, preventing authorisation code interception attacks.
• Pushed Authorisation Requests (PAR): the authorisation request is submitted directly from server to server before the user is redirected, keeping parameters off the front channel.
• Message signing: mandatory in FAPI 1.0 Advanced via JWS request objects; separated into an explicit Message Signing profile in FAPI 2.0.

FAPI does not introduce new cryptography. It removes optionality from OAuth/OIDC, ensuring that implementers cannot inadvertently choose weaker modes.

FAPI 1.0 vs FAPI 2.0

For banks running FAPI 1.0 Advanced, the key structural change in FAPI 2.0 is that message signing is separated into an explicit, optional layer rather than bundled with the base profile. This makes baseline certification simpler, while still enabling full non-repudiation for ecosystems that require it.

FAPI Compliance and Certification

Compliance and certification are distinct. Compliance means an implementation meets the specification. Certification is formal, audited recognition by the OpenID Foundation, published publicly on the OIDF website.

The certification process at a high level looks like this: run the OIDF conformance test suite against the authorisation server, capture the results, and submit them to the OIDF. On successful review, certification is published and the implementation appears on the OIDF’s certified implementations list.

Where certification stands across major markets:

• UK Open Banking (OBIE): passing the FAPI conformance suite is mandatory for banks.
• Brazil Open Finance (BCB): FAPI-aligned implementations are required; certification is part of the ecosystem’s onboarding process.
• Australia CDR, Saudi SAMA, and others: FAPI is referenced as the security baseline; specific certification mandates vary by market.

One important scope point: certification covers the authorisation server. The bank’s wider API surface, including resource server endpoints, still requires correct implementation, ongoing monitoring, and re-conformance as specifications evolve.

Bank-side platforms, including the Ozone API Platform, are built to support FAPI certification across both SaaS and on-premise deployments, which matters where data residency or internal architecture constraints apply.

Related terms

• OAuth 2.0
• OpenID Connect (OIDC)
• PSD2 / PSD3
• mTLS
• DPoP
• PAR (Pushed Authorisation Request)
• Open Banking
• ASPSP / TPP

Frequently asked questions

What does FAPI stand for?

FAPI stands for Financial-grade API. The acronym was coined by the OpenID Foundation FAPI Working Group, which authors and maintains the FAPI security profiles. FAPI 2.0 dropped the financial framing in name to reflect broader applicability, but in current usage the acronym still refers to the same set of specifications.

What is FAPI used for in finance?

FAPI is used to secure APIs that expose bank data or initiate payments. Open banking ecosystems including UK Open Banking, Brazil Open Finance, Australia’s Consumer Data Right, and Saudi Arabia’s SAMA Open Banking framework require FAPI-aligned implementations. Banks deploy FAPI to give third parties standardised, audited access without weakening security.

Is FAPI mandatory?

Mandatory in some jurisdictions, recommended in others. UK Open Banking, Brazil Open Finance, and Saudi SAMA’s Open Banking framework require FAPI conformance. Australia’s CDR and other emerging frameworks reference FAPI as the security baseline. Outside formal mandates, FAPI is the de facto standard for high-stakes API security.

What is the difference between FAPI 1.0 and FAPI 2.0?

FAPI 1.0 has Read-Only and Read-Write profiles, with the Advanced Read-Write profile bundling message signing as a requirement. FAPI 2.0 splits the profile into a Security Profile (the baseline) and a Message Signing profile (optional, for non-repudiation). FAPI 2.0 mandates Pushed Authorisation Requests, simplifies the attacker model, and is easier to implement and certify.

Who needs to be FAPI certified — banks, TPPs, or both?

Certification primarily covers the authorisation server, which is the bank’s responsibility. TPPs implement the client side and must conform to FAPI’s client requirements but typically do not pursue separate FAPI certification themselves. Some ecosystems run a separate TPP onboarding process that includes conformance testing.

Is FAPI required by PSD2 or PSD3?

PSD2 itself does not name FAPI. The European Banking Authority’s RTS sets functional security requirements that FAPI satisfies. While the UK’s OBIE explicitly mandated FAPI from inception for the CMA9 banks, continental European implementations historically relied on a mix of frameworks (such as the Berlin Group). However, European standards have heavily converged toward FAPI profiles. Looking ahead, the incoming PSD3 and Payment Services Regulation (PSR) framework may raise the security bar by mandating stricter, highly harmonized API security and performance standards across the entire EU.

How does FAPI relate to OAuth 2.0 and OpenID Connect?

FAPI is a security profile of OAuth 2.0 and OpenID Connect, not a replacement. It tightens optional OAuth/OIDC choices into a known-secure subset: required client authentication methods, sender-constrained tokens, mandatory PKCE, mandatory PAR in FAPI 2.0. Anything FAPI-compliant is also OAuth-compliant.

Is FAPI used outside open banking?

Increasingly, yes. FAPI 2.0 was deliberately designed to apply beyond finance. Sectors with comparable security requirements, including healthcare, government identity, and regulated B2B data sharing, have begun adopting FAPI 2.0. The OpenID Foundation positions it as a general-purpose high-security API profile. You can read about the specifications for other use cases here.

How long does FAPI certification take?

For an authorisation server already aligned with the spec, running and submitting the OpenID Foundation conformance suite is typically a matter of days. The longer time is in implementation work upstream: configuring the authorisation server, deploying mTLS infrastructure, integrating PAR, and resolving any spec gaps. End-to-end timelines for a bank starting from scratch are usually measured in weeks to months.

Can a FAPI API be deployed anywhere?

Yes. FAPI is a specification, not a hosted service, so a bank can implement it on any infrastructure. Bank-side platforms including the Ozone API Platform support both SaaS and on-premise delivery, which matters where data residency, regulatory restrictions, or internal architecture rule out cloud-hosted authorisation servers.