When your bank lets a budgeting app see your transactions, you should be the one who says yes, decides how long that access lasts, and can take it back whenever you want. Open banking made that the expectation. A security standard called FAPI, short for Financial-grade API, is how it actually works.
SecureAuth is now certified against the final FAPI 2.0 profiles, and we backed the standard while it was still in draft. FAPI is not a banking-only rule. It is adopted across financial services, insurance, telco and energy, anywhere customer data is shared between service providers, and teams that care about how good architecture is supposed to look increasingly treat it as the reference for API security in general. Whichever of those you are building for, the controls your customers and regulators ask about are already part of the platform. You do not have to build them yourself.
Certification here is a checkable claim rather than a marketing one. The OpenID Foundation publishes the conformance tests, a vendor runs them against a named deployment, and passing produces a dated public entry. SecureAuth passed for both the Security Profile and Message Signing.
Key takeaways
- SecureAuth is a certified Financial-grade API (FAPI) 2.0 provider, for both the final Security Profile and Message Signing, and the listing is public on the OpenID Foundation register.
- FAPI is the security standard, born in open banking and now used well beyond it, for putting a consumer in control of who can access their data, for how long, and to do what.
- The same certified authorization server covers every use case on the platform, from customer and partner APIs to AI agents.
- SecureAuth backed FAPI early, certifying against the draft profiles in 2023 as Cloudentity.
- The financial-grade controls (bound tokens, strong client authentication, explicit consent, signed requests) are built into the platform, not sold as a separate product.
What FAPI is, in plain terms
When one company's software calls another company's API to read your data or act for you, three questions have to be answered every time. Is the caller really who it claims to be? Is it doing only what you agreed to? And can anyone later deny what happened? FAPI is a set of rules from the OpenID Foundation that make the sign-in and token technology behind those calls strong enough to answer all three, even when the data is your bank account.
It does that by fixing the weak spots attackers usually go for. A FAPI token is tied to the app it was given to, so a stolen token is useless to anyone else. The app has to prove who it is with more than a shared password. And with Message Signing, every request and response is signed. Signing matters because it gives you proof: a record of exactly what was asked and what came back that neither side can dispute later. When an auditor asks what happened, you can show them instead of just describing it. FAPI is already the required standard in open-banking regimes such as the United Kingdom, Brazil, and Australia, so building on it means meeting a bar regulators around the world already recognize.
What is inside FAPI 2.0
You do not have to wire these up by hand, but it helps to know what the certification actually covers.
Why we tested the whole profile
Saying you support a standard and proving it are two different things. The OpenID Foundation runs an independent test suite, and a certification is a public, dated record that a specific deployment passed. We ran the tests for both the FAPI 2.0 Security Profile and Message Signing, and passed, which is why SecureAuth shows up on the register by name. The entry is public: FAPI 2.0 Security Profile Final and Message Signing Final, dated 23 July 2026, for our SaaS deployment. We did the full Message Signing profile, not just the basics, because the customers who ask for FAPI are the same ones who need that signed proof.
OpenID Certified™ by SecureAuth to the FAPI 2.0 Security Profile Final and FAPI 2.0 Message Signing Final.
Listed 23 July 2026 for the SecureAuth SaaS deployment. Verify on the OpenID Foundation register.
OpenID®, OpenID Certified™ and OpenID Connect™ are trademarks of the OpenID Foundation. Certification is a self-certification published by the OpenID Foundation, not an endorsement of SecureAuth by it.
The same protection covers every use case, including AI agents
The server that passed these tests is not a special edition. It is the same one that already handles employee sign-in, customer and partner logins, and now AI agents. A bank sharing account data with a budgeting app, an insurer opening an API to a broker, and a company giving an AI agent limited access to an account all get the same protections: tokens tied to the caller, consent the user actually gave, and signed requests where they are needed. Financial-grade is the starting point for everything on the platform, not an add-on you buy later.
AI agents are worth singling out. They are becoming heavy users of APIs, and they act for a person who is not watching each step. When an agent calls an API through the platform, it gets a token tied to it, and you can require it to sign every request. Agent Authority gives each agent its own cryptographic identity, so the same rules that protect someone's bank data also decide what an agent may do with it. The longer argument for why agent traffic needs this floor, and what a gateway cannot decide on its own, is in AI agents are becoming your biggest API consumer.
We were early to this
As Cloudentity, the team now part of SecureAuth passed certification against the FAPI 2.0 draft profiles in May 2023, only months after those drafts were published. SecureAuth then built that technology into the core of the platform, so the rest of our products rely on it today.
Getting certified again in 2026 against the final version is us keeping that going. We track the standard as it changes and stay current, so no customer waits on us for the profile their auditor is asking about.
FAQ
What is FAPI 2.0?
Financial-grade API (FAPI) 2.0 is a set of OpenID Foundation rules that make OAuth 2.0 and OpenID Connect strong enough for sensitive data, using tokens tied to the caller and stronger proof of identity. It came out of open banking and is now the common bar for protecting data over APIs.
What is a certified FAPI 2.0 provider?
A certified Financial-grade API (FAPI) 2.0 provider is an identity or authorization platform that has passed the OpenID Foundation conformance tests for the FAPI 2.0 Security Profile. SecureAuth is certified for both the Security Profile Final and Message Signing Final, dated 23 July 2026.
What does Message Signing add, and why does it matter?
It signs each request and response, so both sides have proof of exactly what was asked and returned. That proof is what an auditor or regulator will accept, instead of a description of what you think happened.
Does this apply beyond banking?
Yes. The certified server is the same one behind workforce, customer, partner, and AI agent access, so every use case on the platform gets these protections without a separate product or a migration.
How do I verify the certification?
It is on the OpenID Foundation certification register for FAPI 2.0 Security Profile Final and Message Signing Final, dated 23 July 2026, under SecureAuth's SaaS deployment.