Solutions Industry

FinTech and open banking

Open banking and payment APIs are regulated to a specific security profile. LumoAuth implements FAPI 2.0 with pushed and signed requests, DPoP and mutual-TLS-bound tokens, and the backchannel flow that lets a bank ask a customer to approve a payment on their phone.

Start free FAPI 2.0

Regulators specify the profile; most auth products stop at the basics

PSD2 strong customer authentication, FAPI conformance and audit obligations are not optional features for a bank or a payment initiator.

How LumoAuth solves it

FAPI 2.0 security profile

Turn it on per application: PAR, PKCE, signed requests and responses, sender-constrained tokens. Docs

Sender-constrained tokens

DPoP or mutual TLS so a stolen token cannot be replayed. Docs

Backchannel authentication (CIBA)

The bank initiates; the customer approves on their own device. Docs

Rich authorization requests

Describe the exact payment or account access a token covers. Docs

Strong customer authentication

Passkeys, push approval and adaptive step-up cover the possession and inherence factors. Docs

Audit for regulators

Complete logs, long retention, streaming to your SIEM, and keys in an HSM. Docs

Setting it up

Create the application with the FAPI profile

Register client certificates or DPoP keys

Enable CIBA for payment approvals

Stream the audit log to your SIEM

Standards involved

Plain names on the left, the specification on the right. The full map is in the standards reference.

FAPI 2.0: OpenID FAPI 2.0 Security Profile
PAR, JAR, JARM: RFC 9126, RFC 9101, JARM
DPoP and mTLS: RFC 9449, RFC 8705
CIBA: OpenID CIBA Core 1.0
Rich authorization requests: RFC 9396

Standards reference on the docs site

Which plan you need

FAPI 2.0, mutual TLS and CIBA are on the Business plan. DPoP starts on Pro. Bring-your-own HSM keys is a Business add-on.

See all plans and add-ons

Documentation

FAPI 2.0docs.lumoauth.dev/oauth/fapi CIBAdocs.lumoauth.dev/oauth/ciba Client attestationdocs.lumoauth.dev/oauth/client-attestation Security profiledocs.lumoauth.dev/oauth/security

Questions

Is LumoAuth FAPI certified?

The implementation follows the FAPI 2.0 profile; ask us for the current conformance status for your deployment.

Ship passwordless sign-in this week. Put guardrails on your agents today.

The Developer plan is free for 10,000 monthly users and ten agents, with no card. Everything speaks open standards, so moving in or out is a config change.

Start free Talk to us Read the docs