Senior LevelAuthentication & Authorization
What is the Financial-grade API (FAPI 2.0) Security Profile and how does it secure Open Banking APIs?
❓ Interview Prompt: Explain FAPI 2.0 Security Profiles, mandatory PKCE, mTLS / DPoP sender-constrained tokens, signed request objects (JAR), and auditability.
Standard OAuth 2.0 security is insufficient for high-risk financial and healthcare environments. Financial-grade API (FAPI 2.0) is an international security standard developed by the OpenID Foundation that defines strict security profiles for Open Banking.
Mandatory FAPI 2.0 Security Controls:
1
Mandatory PKCE & PAR: Disallows plain OAuth redirects; requires Pushed Authorization Requests (PAR) and PKCE.
2
Sender-Constrained Tokens: Disallows plain Bearer tokens. Mandates mTLS (RFC 8705) or DPoP (RFC 9449) key binding.
3
Signed Request Objects (JAR / RFC 9101): Authorization parameters must be formatted as cryptographically signed JWTs (JWS).
4
Asymmetric Client Authentication: Disallows client secrets; mandates private key JWTs ('private_key_jwt') or mTLS.
Code Implementation Example
typescript
// FAPI 2.0 Compliant Authorization Request Header Config
const fapiHeaders = {
'Authorization': 'DPoP ' + accessToken, // Mandatory DPoP sender-constrained scheme
'DPoP': dpopProofJwt, // Signed client proof
'x-fapi-interaction-id': crypto.randomUUID(), // Mandatory end-to-end tracing UUID
'x-fapi-auth-date': new Date().toUTCString()
};💡FAPI 2.0 compliant request headers requiring DPoP and x-fapi-interaction-id tracing.
🎯 Interview Key Takeaway
FAPI 2.0 mandates PAR, PKCE, DPoP/mTLS key-bound tokens, and signed request objects for high-security Open Banking APIs.
#FAPI 2.0#Open Banking#Financial Security#OIDC#Senior
Back to all Authentication & Authorization Questions→