FAPI 2.0

FAPI 2.0 is an API security profile based on the OAuth 2.0 framework suitable for protecting APIs in high-value scenarios.

The core FAPI functionality is split into two documents, with a third that describes the attacker model

• FAPI 2.0 Security Profile (Final)
• FAPI 2.0 Attacker Model (Final)
• FAPI 2.0 Message Signing (Draft)

Specifications Referenced by FAPI

• RFC 6749 - OAuth 2.0 Framework
• RFC 6750 - OAuth 2.0 Bearer Token Usage
• RFC 7521 - Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants
• RFC 7523 - JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants
• RFC 7636 - Proof Key for Code Exchange
• RFC 7662 - OAuth 2.0 Token Introspection
• RFC 8252 - OAuth 2.0 for Native Apps BCP
• RFC 8414 - OAuth 2.0 Authorization Server Metadata
• RFC 8705 - Mutual TLS Client Authentication and Certificate-Bound Access Tokens
• RFC 8725 - JSON Web Token Best Practices
• RFC 9101 - JWT Secured Authorization Request (JAR)
• RFC 9126 - Pushed Authorization Requests (PAR)
• RFC 9207 - OAuth 2.0 Authorization Server Issuer Identification
• RFC 9449 - DPoP: Demonstrating Proof-of-Possession at the Application Layer
• RFC 9421 - HTTP Message Signatures
• RFC 9530 - HTTP Digest Headers
• RFC 9700 - Best Current Practice for OAuth 2.0 Security
• RFC 9701 - JWT Response for OAuth Token Introspection
• JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)

More resources

• Exploring Financial-Grade API (FAPI) with Torsten (Identity Unlocked Podcast)
• FAPI 2.0: Security Profile (Simpler Security, Yes!) (Raidiam)
• All OpenID FAPI Working Group Drafts