What is the fundamental difference between standard OAuth 2.0/2.1 and FAPI 2.0?

Standard OAuth 2.0/2.1 relies on bearer tokens, which can be replayed by any party that intercepts them across intermediate proxies, logs, or network taps. FAPI 2.0 (Financial-Grade API 2.0 Security Profile) is a hardened security specification published by the OpenID Foundation designed specifically for high-value financial transactions, open banking, and healthcare. FAPI 2.0 strictly mandates sender-constrained tokens (via mTLS client certificate binding or DPoP cryptographic proofs), Pushed Authorization Requests (PAR RFC 9126) to prevent front-channel URL parameter leakage, PKCE with S256, and signed authorization responses (JARM), rendering stolen tokens mathematically unusable.

How does RFC 9396 Rich Authorization Requests (RAR) solve the limitations of OAuth scopes?

OAuth scopes are flat, unstructured string tokens (e.g. "scope=payment:write" or "scope=read_accounts") that provide zero visibility into transaction context. A payment client with "payment:write" could initiate a $10 transfer or a $1,000,000 transfer without the authorization server knowing the difference at consent time. RFC 9396 Rich Authorization Requests (RAR) introduces the structured "authorization_details" JSON array, enabling clients to express fine-grained transaction intents—such as exact amounts, ISO 4217 currencies, debtor and creditor IBANs, maximum execution frequencies, and validity windows—which the bank authorization server cryptographically signs into the resulting access token.

What is Pushed Authorization Requests (PAR RFC 9126) and why is it mandatory in FAPI 2.0?

In legacy OAuth, all authorization parameters (client ID, redirect URI, scope, state, and complex payment data) were passed as query parameters in the browser address bar. This exposed sensitive financial details to browser histories, reverse proxy access logs, TLS-terminating proxies, and Referer headers. PAR moves parameter transmission to a direct, authenticated back-channel HTTP POST request from the client to the authorization server endpoint (/as/par). The server validates the request and returns a short-lived (e.g. 60-second), single-use "request_uri" reference (e.g. "urn:ietf:params:oauth:request_uri:b4f..."), which is the only parameter sent through the browser.

How does mTLS certificate binding (RFC 8705) sender-constrain an access token?

During mutual TLS (mTLS) handshake, the client presents an X.509 client certificate to the authorization server and resource server. When issuing an access token, the authorization server computes the SHA-256 hash of the client DER-encoded certificate and embeds it in the token "cnf" (confirmation) claim: "cnf": { "x5t#S256": " " }. When the client sends the token to a protected API, the API gateway inspects the incoming mTLS connection, computes the thumbprint of the client certificate, and verifies it matches the "x5t#S256" claim. If a malicious third party steals the token, they cannot present the matching private key during the TLS handshake, and the request is immediately rejected.

Verified Specification | Standardized Formulas | Instant Precision

Secure & Private (Zero Data Retention) Free Access • No Sign-Up

Financial-Grade API (FAPI 2.0) & Rich Authorization Requests (RAR) Architecture Studio

RFC 9396 Structured Authorization Details, FAPI 2.0 Sender-Constrained Tokens (mTLS & DPoP), PAR Back-Channel Lifecycle, and Open Banking Standards

Modern Open Banking (UK Open Banking, Australia CDR, Brazil Open Finance, EU PSD2/PSD3) and healthcare standards (SMART on FHIR) prohibit unconstrained bearer tokens. This studio models the complete FAPI 2.0 Security Profile, RFC 9396 Rich Authorization Requests (RAR), Pushed Authorization Requests (PAR RFC 9126), and mTLS certificate thumbprint binding (cnf.x5t#S256).

1. RFC 9396 Rich Authorization Requests (RAR) Builder & Validator

Design Structured authorization_details JSON Payloads for Payments, Consents, & Account Scopes

Financial Intent Template

Sender Constraining Mechanism

Interactive RFC 9396 authorization_details Array (Live JSON)

2. FAPI 2.0 Sender-Constrained JWT Claims Inspector

Cryptographic Binding of Client Identity to Prevent Token Replay & Man-In-The-Middle Exploits

Generated FAPI 2.0 Access Token Claims (Decoded Payload)

3. Pushed Authorization Requests (PAR RFC 9126) & JARM Flow Machine

Eliminating Browser Front-Channel Leakage via Back-Channel PAR and Signed JARM Responses

STEP 1 (Back-Channel)

mTLS Back-Channel PAR Initiation (POST /as/par)

Client authenticates with mutual TLS X.509 cert and POSTs complete RAR authorization_details, PKCE code_challenge (S256), and scopes directly to the AS. Zero data travels through the browser.

STEP 2 (Back-Channel)

AS Validates Intent & Emits Single-Use request_uri

Authorization Server checks transaction limits against banking policies, stores session state, and returns HTTP 201: {"request_uri": "urn:ietf:params:oauth:request_uri:7b1e4c9f...", "expires_in": 60}.

STEP 3 (Front-Channel)

Lean Browser Redirection (GET /as/authorize)

User browser redirects to: https://bank.com/as/authorize?client_id=fintech-app&request_uri=urn:ietf:params:oauth:request_uri:7b1e.... Notice: Zero IBANs, zero monetary amounts, and zero PII exist in the URL string!

STEP 4 (Front-Channel)

Strong Customer Authentication (SCA) & Consent

Bank presents exact payment details from the stored RAR payload. User authorizes via FIDO2 / WebAuthn biometric passkey or hardware security token under PSD2 Regulatory Technical Standards (RTS).

STEP 5 (Back-Channel)

mTLS Token Exchange with cnf.x5t#S256 Binding

Client exchanges authorization code via mTLS POST /token. AS issues access token containing structured RAR permissions and cryptographically bound certificate thumbprint.

4. Production Open Banking Code & Gateway Policies

Enterprise Go PAR Client, Python RAR Validator, and Reverse Proxy mTLS Verification

Financial-Grade API (FAPI 2.0) & Rich Authorization Requests (RAR) Architecture Studio

1. RFC 9396 Rich Authorization Requests (RAR) Builder & Validator

2. FAPI 2.0 Sender-Constrained JWT Claims Inspector

3. Pushed Authorization Requests (PAR RFC 9126) & JARM Flow Machine

4. Production Open Banking Code & Gateway Policies

🔍 Companion Workbenches & Verification Tools

Plonky3 Goldilocks & BabyBear Prime Field Studio | Small-Field Fast ZK Proving

X.509 Certificate Decoder & CSR Inspector Studio

RFC 3161 & Sigstore Timestamp Authority Studio: Immutable Cryptographic Provenance

Bulletproofs & Zero-Knowledge Range Proofs Studio

Why Smart Users Are Switching to This Free Toolkit

The Browser Feature Most People Never Use

Stop Paying for Software You Can Get Free

File Conversion Tricks That Save Hours Every Week

This Free Tool Replaced 5 Paid Apps for Our Team

What Your Browser Can Do Without Any Extensions