FAPI

FAPI is the Financial-grade API profile built on OpenID Connect and OAuth 2.0. It defines security requirements for protecting requests, responses, clients, and delegated access in high-risk financial environments where ordinary API controls are not enough.

Expanded Definition

FAPI, or Financial-grade API, is a security profile that tightens OpenID Connect and OAuth 2.0 for high-risk delegated access. It is used when an API must resist token theft, request tampering, redirect manipulation, replay, and client impersonation in environments where financial loss or regulated data exposure is a realistic outcome. Unlike baseline OAuth deployments, FAPI expects stronger client authentication, sender-constrained tokens, signed requests, and stricter redirect and consent handling. The exact implementation pattern still varies across vendors and relying parties, but the security intent is consistent: reduce trust in the network path and bind each transaction more tightly to the legitimate client and user context. In practice, FAPI is often discussed alongside NIST Cybersecurity Framework 2.0 because both emphasize control integrity and resilience rather than mere login success. The most common misapplication is treating FAPI as a branding layer over standard OAuth, which occurs when teams enable the profile name but leave weak client authentication, unsigned requests, or bearer-only tokens in place.

Examples and Use Cases

Implementing FAPI rigorously often introduces integration friction, requiring organisations to weigh stronger transaction integrity against the cost of upgrading clients, authorization servers, and test tooling.

• Open banking portals use FAPI so a customer’s consented access to account data cannot be silently redirected to an attacker-controlled endpoint.
• Fintech partner APIs use signed authorization requests and stricter redirect validation to reduce the risk of code interception during delegated authorization.
• Payment initiation services use sender-constrained access tokens so a stolen token cannot be replayed from a different client or device.
• Customer-facing aggregation platforms use FAPI-style controls to align with high assurance identity flows and reduce abuse of long-lived API sessions.
• Security teams reviewing a breach scenario often compare API behavior against guidance in the McDonald’s McHire AI Chatbot Default Credentials case to understand how weak defaults and exposed access paths can turn into systemic exposure.

FAPI is also commonly paired with formal API governance and stronger identity assurance expectations in the broader OAuth and OIDC ecosystem, especially where the consumer of the API is a partner rather than an internal service.

Why It Matters in NHI Security

FAPI matters in NHI security because many high-value API failures are really NHI failures in disguise: an API client, service account, or delegated application is over-trusted, over-scoped, or insufficiently bound to its credentials. That pattern is visible in NHIMG research, where 97% of NHIs carry excessive privileges and 79% of organisations have experienced secrets leaks, with 77% of those incidents causing tangible damage. In a FAPI context, excessive privilege turns a compromised client into a powerful pivot point, while leaked tokens or keys can undermine the very trust assumptions the profile is meant to enforce. Security teams should view FAPI as part of a larger control stack that includes secret handling, lifecycle governance, and least privilege, not as a standalone compliance badge. The profile becomes especially important when APIs expose payments, customer data, or delegated consent paths to third parties. Organisations typically encounter the operational need for FAPI after a token replay, partner compromise, or redirect abuse incident, at which point the profile becomes unavoidable to address.