FAPI is an OpenID Foundation standard for APIs with high-security requirements. FAPI 1.0 targeted financial APIs; FAPI 2.0 broadens the approach to domains such as healthcare and adds security requirements. section 10.2
FAPI constrains OAuth 2.0 and OpenID Connect to protect three things: authorization, authentication, and session integrity. It prevents attackers from using another user’s access token, impersonating users, or tampering with authorization messages. section 10.3 section 10.2
A payment authorization attack
A user already signed in to an identity provider visits a malicious site. The site sends a forged authorization request, causing an authorization code to leak; it can then exchange that code for an access token. FAPI addresses this risk through authenticated clients, protected request handling, and integrity-protected responses. section 10.7
A FAPI 2.0 deployment organizes security around these requirements:
- Use confidential clients, whose server-side code can securely store credentials and authenticate authorization-server requests. section 10.4
- Use the security profile for baseline access-token issuance and sensitive resource-server access. section 10.4
- Use JAR, PAR, and JARM to protect authorization requests and responses from tampering. section 10.7
- Use message signing when nonrepudiation is needed for legally or financially consequential actions. section 10.2 section 10.7
- Use sender-constrained tokens, such as certificate-bound or DPoP tokens, so stolen tokens cannot be used freely. section 10.7
