Definition
FAPI 2.0 (Financial-grade API Security Profile 2.0) is the OpenID Foundation profile for high-security OAuth + OIDC deployments — particularly in open banking and other financial-services contexts.
In more depth
FAPI tightens OAuth + OIDC for high-stakes environments. FAPI 2.0 (the current generation) mandates PKCE for all clients, requires sender-constrained tokens via DPoP or mTLS, requires JAR (JWT Authorization Request) for the /authorize call, and constrains acceptable signing algorithms.
FAPI is mandated by open-banking regimes in UK (Open Banking), Australia (CDR), Brazil (Open Finance), and others. As of 2024-2026, it's the de-facto requirement for any new high-security OAuth deployment.
Want the work, not just the definition?