Skip to main content
This page is for Authlete 2.x. For 3.0, see FAPI 2.0 Message Signing Profile – Signing Authorization Requests (3.0).

​
FAPI 2.0 Message Signing – Signing Auth Requests (2.x)

The FAPI 2.0 Message Signing profile extends the FAPI 2.0 Security profile. It defines requirements for:
  1. Signing Authorization Requests
  2. Signing Authorization Responses
  3. Signing Introspection Responses
  4. Signing HTTP Messages
FAPI2 MS Auth Req (Signing Authorization Requests) is supported since Authlete 2.3.

​
Flow (2.x)

  1. Pushed Authorization Request – Client sends a signed request object to the PAR endpoint; client authentication via mutual TLS or private_key_jwt.
  2. Pushed Authorization Response – Server returns a request_uri.
  3. Authorization Request – Client sends request_uri to the authorization endpoint.
  4. Authorization Response – Server returns authorization code.
  5. Token Request – Client exchanges the code; access tokens are sender-constrained (mutual TLS or DPoP). private_key_jwt is used for client auth at the token endpoint.
  6. Token Response – Sender-constrained access token.
  7. API Request – Client calls the resource with the access token and proof-of-possession.

​
Scope Attribute (2.x)

Scope attribute for FAPI2 MS Auth Req:
attribute keyattribute value
fapi2ms-authreq

​
Service Configuration (2.x)

Configure your service as follows to comply with FAPI2 MS Auth Req (Authlete 2.3+). In Service Owner Console (so.authlete.com) the equivalent settings are under Basic, Authorization (grant types, response types, authorization endpoint, token endpoint, PAR endpoint, request object), Token, and Scope.
PropertyDescription
Supported Grant TypesInclude AUTHORIZATION_CODE.
Supported Response TypesInclude CODE.
Supported Service ProfilesInclude FAPI.
iss Response ParameterSelect Included.
Token Endpoint URISet your authorization server’s token endpoint URI.
Supported Client Authentication MethodsSelect PRIVATE_KEY_JWT.
nbf ClaimSelect Required.
Audience ValidationSelect Perform.
Access Token Signature AlgorithmIf using JWT access tokens: PS256, ES256 or EdDSA.
Supported ScopesInclude a scope with the FAPI2 MS Auth Req attribute (fapi2 / ms-authreq).
JWK Set / JWK Set Endpoint URIIf using JWK Set for JWT access token signing: set JWK set or an https URI to the JWK set.

​
Client Configuration (2.x)

PropertyDescription
Client TypeCONFIDENTIAL.
Grant TypesInclude AUTHORIZATION_CODE.
Response TypesInclude CODE.
Redirect URIsAt least one redirect URI.
Client Authentication MethodPRIVATE_KEY_JWT.
Assertion Signature AlgorithmPS256, ES256 or EdDSA.
ID Token Signature AlgorithmIf ID tokens are issued and signed: any algorithm other than NONE.
ID Token Encryption AlgorithmIf ID tokens are issued and encrypted: any algorithm other than RSA1_5.
JWK Set Content / JWK Set URIIf used: JWK set or an https URI for client assertion signing.

​
API Call Example (2.x)

The authorization server calls Authlete APIs in the same way as in 3.0. Example: when the client sends a valid PAR request with a signed request object and client assertion, the server forwards the parameters to /api/pushed_auth_req (or the 2.x equivalent endpoint). A successful response contains requestUri and responseContent (with expires_in and request_uri). For full request/response examples for /pushed_auth_req, /auth/authorization, /auth/authorization/issue, /auth/token, and /auth/introspection, see the FAPI 2.0 Message Signing – Signing Authorization Requests (3.0) page; the same flow and API usage apply to Authlete 2.x (2.3+).