Skip to content

FAPI_Meeting_Notes_2025 02 19_Atlantic

Jump to bottom
Nat Sakimura edited this page Jul 10, 2026 · 1 revision

FAPI Working Group Meeting Notes

  • Date: February 19, 2025
  • Time: 14:00 GMT
  • Location Zoom

Attendees

Nat Sakimura (Chair), Dave Tonge, Mike Leszcz (OIDF), Dima Postnikov, Bjorn Hjelm, Hideki Ikeda, Filip Skokan, Peter Wallach (Mastercard), Robert Gallagher (Mastercard), George Fletcher, Peter Stanley (OBL), Kosuke Koiwai

1. Roll Call

Attendance was taken via chat window.

2. Adoption of Agenda

The agenda was adopted as presented:

  1. Roll Call
  2. Adoption of Agenda
  3. Events
  4. External Orgs & Liaisons
  5. PRs
  6. Issues
  7. AOB

3. Events

Mike Leszcz shared upcoming events:

3.1 FAPI 2.0 Security profile and attacker model is FINAL

Mike Leszcz began by congratulating the FAPI Working Group for getting the FAPI 2 specifications approved on Saturday prior to the meeting. He noted:

  • The results announcement and updated final spec links (prepared by Dave Tonge) were being finalized for publication later that day.
  • A follow-up would be sent via the working group mailing list once published.

3.2 Other events

  • OSW 2025: Feb 26-28 in Reykjavik, Iceland
  • DICE: March 4-5 in Zurich
  • ISO/IEC JTC 1/SC 27/WG5: March 10-15, 2025 in Fairfax
  • ISO/IEC JTC 1/SC 27: March 17-18, 2025 in Fairfax
  • MOSIP Connect: March 11-13 in Philippines
  • IETF: March 15-21 in Bangkok
  • OIDF Workshop prior to IIW: April 7th at Google in Mountain View
    • DCP WG meeting prior to the workshop
  • IIW Spring 2025: April 8-10

The OIDF calendar on the website is current: https://openid.net/calendar/

4. External Orgs & Liaisons

Mike Leszcz provided ecosystem updates:

  • Announced FAPI 2 specifications have been approved
  • Working on annual FAPI recertifications for Open Finance Brazil and Open Insurance Brazil
    • January 2025 was one of the largest months for certification requests
  • Coordinating with Dima on a follow-up meeting with CMF in Chile
    • Dima is working on a reference architecture for a white paper
    • CMF will provide input while OIDF continues supporting their FAPI 2 adoption
  • Will notify all ecosystem partners about the FAPI 2 finalization

5. PRs

Dave Tonge provided an update on outstanding PRs:

  • Cross-device flow PR: still needs improved notes
  • Message signing spec: awaiting updated reference to security analysis from researchers
    • Once received, will submit final document for message signing

6. Issues

Several issues were discussed:

Issue #724: Move FAPI 1/FAPI 2 comparison table from spec

  • Dima raised the issue that the comparison table might not be relevant for ecosystems adopting FAPI 2 directly
  • Determined it's too late to remove as specs are already approved
  • Issue closed

Issue #722: Summary of changes between FAPI2-SP-ID2 and final

  • Dima is working on documenting differences between the last implementer's draft and the final version
  • Requested reviewers to help validate the document
  • Particularly relevant for ecosystems migrating from ID2 to the final version

Issue #598: State parameter length

  • Discussion about what happened to the state parameter length requirements
  • General recollection that it was moved to implementation guidelines
  • Current spec only mentions state parameter value could exceed 1,000 characters

Issue #425: FAPI 2.0 purpose and FAPI WG scope

  • Nat and Dave have been exchanging emails to move this forward

Other issues:

  • Conformance team will discuss the private key JWT audience issue at their in-person meeting next week

7. AOB

No other business was raised.

The meeting adjourned early, returning approximately 40 minutes to participants.

Action Items

  • Mike Leszcz: Publish FAPI 2 results announcement and spec links, then notify the working group via email.
  • Dave Tonge: Incorporate security analysis reference into the Message Signing spec and submit the final document.
  • Dima Postnikov: Share Google Doc on FAPI 2 differences with interested reviewers (collect emails post-meeting).
  • Conformance Team: Discuss Private Key JWT audience issue options at the Reykjavik meeting and report back to the WG.
  • Dave Tonge & Nat Sakimura: Continue progressing Issue #425 (FAPI 2.0 purpose and WG scope).

Next Steps

  • Await FAPI 2 announcement and spec links from Mike.
  • Monitor updates from the conformance team’s Reykjavik meeting (Feb 26-28, 2025).
  • Volunteers to contact Dima for reviewing the FAPI 2 differences document.

Clone this wiki locally