FAPI

OAuth 2.0 is flexible by design, and flexibility is precisely what a bank doesn't want. The OpenID Foundation working group, which first called the standard Financial API, therefore removed everything risky and made the rest mandatory. The implicit flow is banned, and clients must authenticate with mTLS or a signed JWT rather than a shared secret. Access tokens are bound to the client's key, so an intercepted token is useless to anyone else.

FAPI 1.0 was finalised in 2021 and was already the backbone of UK open banking by then. FAPI 2.0 simplifies the recipe by pushing the authorisation request straight to the server (PAR) and requiring PKCE. Brazil and Australia built their open data regimes on the profile. In the EU, banks interpreted PSD2 on their own, often via the Berlin Group.