Finance · security identity · OpenID Foundation — FAPI Working Group; editors D. Fett (Authlete), D. Tonge (Moneyhub Financial Technology), J. Heenan (Authlete)
FAPI 2.0 Security Profile
The FAPI 2.0 Security Profile is the OpenID Foundation’s current high-security profile of OAuth 2.0, published as a Final specification on 22 February 2025. It admits only confidential clients, requires pushed authorization requests, PKCE with S256 and sender-constrained access tokens (mTLS or DPoP), and is designed against an explicit attacker model rather than a list of best practices.
openid.net/specs/fapi-security-...The standard
OpenID Foundation — FAPI Working Group; editors D. Fett (Authlete), D. Tonge (Moneyhub Financial Technology), J. Heenan (Authlete)Governing body
2025First published
Final (22 February 2025)Current version
No — a normative prose profile of OAu...Machine-readable schema
0providers in the catalog
Also known as FAPI 2.0, FAPI 2.0 Security Profile, FAPI2.
Providers that carry FAPI 2.0 Security Profile 0
No provider in the catalog carries this standard as a tag yet. That is a statement about the catalog's tagging, not about adoption: a provider that implements FAPI 2.0 Security Profile and says so in its APIs.json profile appears here on the next build. Add or correct a listing.
Reading
Read from the API Evangelist standards directory, facts verified 2026-09-17. Provider links come from the catalog's own identity tags and are rebuilt nightly. If this page is wrong about a standard or a provider, say so.