Tarun Garg·Nov 12, 2025FAPI must for Open Banking UKOne cannot legally expose APIs for payments or account data without meeting FAPI-level security. Without FAPI:
Declerus Yves Kerbens·Jul 30, 2025Sender-Constrained Web Security: From DPoP-Bound Sessions to End-to-End AuthorizationIntroduction
Declerus Yves Kerbens·Jul 22, 2025Sender-Constrained DPoP + JAR/PAR OIDC Flow (Browser to RP): Full Technical Design1. Executive SummaryA response icon1A response icon1
InCodeToDeploybyKunal Sinha·Jul 8, 2025Security in OAuth2 : non-repudiation and integrityNon-repudiation is a critical security property that ensures an actor cannot deny having sent a message or performed an action. In…
Dima Postnikov·Mar 19, 2025Implementers Guide: FAPI 2.0 Final specification vs. Implementers Draft 2.0What’s new in FAPI 2 final?
Takahiko Kawasaki·Feb 14, 2025OAuth/OIDC Implementation Mistakes!How We Overcame Overlooked Details and Breaking Changes in the Specifications
Arjun Balla·Jan 2, 2025Why FAPI mandates `code id_token` even when Client does not need an id_token?because it is suggested as a alternative to JARM with minimum impact to the Client and Authorization Server.A response icon1A response icon1
oneIAM·Oct 14, 2024OAuth 2.0 — PAR (Pushed Authorization Requests with WSO2 IS 7.0.0)In OAuth 2.0, PAR (Pushed Authorization Request) is a mechanism introduced to securely transmit the authorization request parameters to…
hidebike712·Feb 19, 2024FAPI 2.0 ExplainedExploring the Latest in API SecurityA response icon1A response icon1
