Financial-grade API security profile overview
Learn what the Financial-grade API (FAPI) security profile is, when you have to comply with it, and how SecureAuth helps you protect your APIs in a FAPI-compliant way.
SecureAuth FAPI 2.0 certification
SecureAuth is certified against the FAPI 2.0 Security Profile and FAPI 2.0 Message Signing final specifications. The SecureAuth SaaS platform was certified on 23 July 2026 and appears in the OpenID Foundation FAPI 2.0 certification directory.
For the certified conformance profiles, and for the FAPI 1.0 Advanced and Open Banking certifications, see Certifications.
What Financial-grade API (FAPI) is
Financial-grade API (FAPI) is an API security standard defined by the OpenID Foundation. It extends the OAuth 2.0 and OpenID Connect (OIDC) frameworks with the stronger security the financial industry needs.
FAPI profiles
The OpenID Foundation defines five FAPI profiles:
FAPI 2.0 builds on FAPI 1.0 and on wider learnings from the OAuth ecosystem, including the OAuth Security Best Current Practice. It aims to match and exceed the security of FAPI 1.0 while reducing complexity, which makes it easier and more cost-efficient to implement.
FAPI 1.0 defines two levels of compliance, Baseline and Advanced. FAPI 2.0 does not use levels. It defines a single Security Profile, paired with an Attacker Model that expresses the security requirements as security goals and attacker models.
FAPI security requirements
The following are examples of the security FAPI adds.
Strong Customer Authentication (SCA)
FAPI requires multi-factor authentication (MFA). MFA typically combines at least two of the following: something you know, such as a password; something you have, such as a mobile device; and something you are, such as a biometric.
Request object signing
FAPI extends standard OAuth 2.0 with signed request objects. A signed request object is a JWT that carries all the OAuth 2.0 authorization request parameters. The client signs the JWT and the authorization server verifies it, which protects the integrity of the request and supports non-repudiation.
Token binding
FAPI binds issued tokens to a particular client. This reduces the risk that comes with bearer tokens and makes it harder for an unauthorized client to misuse one.
Mutual TLS (mTLS)
FAPI requires both the client and the server to present certificates for mutual TLS. Each end of the connection authenticates the other.
FAPI compliance and interoperability
You can configure FAPI profiles to align with regulatory requirements such as the EU's Payment Services Directive 2 (PSD2), the Australian Consumer Data Right (CDR), and the UK's Open Banking Standard. For the profile each open finance ecosystem uses, see API security profile requirements for open finance initiatives.
FAPI authorization server
SecureAuth offers a multi-tenant authorization server that meets FAPI requirements out of the box.
You can tailor Fintech and mission-critical applications workspaces to the FAPI specification you choose: FAPI 1.0 Advanced, FAPI 2.0 Security Profile, or FAPI 2.0 Message Signing. Change the settings of an existing workspace to meet FAPI requirements, or create a new Fintech and mission-critical applications workspace and select the FAPI profile when you create it.
You can also configure any other server profile for FAPI compliance.
Next steps
Create a workspace of Fintech and mission-critical applications profile.