APIs (short for application programming interface) are commonly used in distributed software applications, including web apps. In short, they allow one program to communicate with or leverage functionality from another app or system. They are especially commonplace in web applications, but also see widespread use in mobile and desktop apps.
With more retail, banking, and other financial interactions taking place online, securing APIs grows in importance. As a result, the OpenID Foundation developed a specification for a financial-grade API (FAPI). It provides a framework for transmitting financial data across systems leveraging OpenID Connect (OIDC) and OAuth 2.0. Both serve as industry standards for web-based identity and access management.
Let’s take a closer look at the FAPI standard in software applications with financial functionality. It’s an important concept that is quickly becoming valuable to fintech hiring managers.
A Closer Look at FAPI: the Financial-Grade API Standard
Once again, the OpenID Foundation created the FAPI standard to improve the security of APIs used for financial applications. Both OIDC and OAuth 2.0 are widely used for identity management and access delegation purposes. However, the Foundation felt that the APIs used in modern e-commerce and financial applications needed stronger security. Enter FAPI.
OIDC and OAuth 2.0 simply failed to handle some of the scenarios leading to FAPI’s creation. These use cases requiring enhanced security include the following:
- Financial transfers valued in the millions
- Real-time payments
- Secure user data transmission between banks and other financial institutions
- Supporting stronger regulatory compliance requirements in Europe and the US
The design goal for FAPI included stronger protections for communicating between applications and the APIs they leverage. These features include enhanced cryptographic integrity, proof of possession, and verifiable authorization flows. The OpenID Foundation’s ultimate goal involved providing a foundation to support security in an open banking world. Notably, the EU’s PSD2 directive defined many of the requirements found in the FAPI 1.0 specification.
Important Technical Features of FAPI 1.0
The FAPI 1.0 specification offers a framework for boosting the security requirements of APIs used in financial applications. Some of the features supported by this spec include:
- Signed Authorization Requests: This feature prevents unethical hackers from tampering with parameters within the objects used to authorize API access.
- Proof Key for Code Exchange (PKCE): Using PKCE protects authorization codes from injection attacks.
- Sender-Constrained Access Tokens: The access tokens used for connecting to APIs are bound to the client, protecting against malicious attack.
- Stronger Protection against Cross-Site Request Forgery (CSRF): This feature enforces the uniqueness of each transaction, ensuring protection against CSRF attacks.
If you want to build or maintain a software engineering career in fintech, understanding FAPI remains critical. Check out the OpenID Foundation’s FAPI resources for more information.
Want to explore fintech software development opportunities? Connect with the experienced recruiters at The CERES Group. Let’s take your career to a higher level!
