Skip to main content
This page is for Authlete 2.x. For 3.0, see FAPI 2.0 Message Signing Profile – Signing Authorization Requests (3.0).

​
FAPI 2.0 Message Signing – Signing Auth Requests (2.x)

The FAPI 2.0 Message Signing profile extends the FAPI 2.0 Security profile. It defines requirements for:
  1. Signing Authorization Requests
  2. Signing Authorization Responses
  3. Signing Introspection Responses
  4. Signing HTTP Messages
FAPI2 MS Auth Req (Signing Authorization Requests) is supported since Authlete 2.3.

​
Flow (2.x)

  1. Pushed Authorization Request – Client sends a signed request object to the PAR endpoint; client authentication via mutual TLS or private_key_jwt.
  2. Pushed Authorization Response – Server returns a request_uri.
  3. Authorization Request – Client sends request_uri to the authorization endpoint.
  4. Authorization Response – Server returns authorization code.
  5. Token Request – Client exchanges the code; access tokens are sender-constrained (mutual TLS or DPoP). private_key_jwt is used for client auth at the token endpoint.
  6. Token Response – Sender-constrained access token.
  7. API Request – Client calls the resource with the access token and proof-of-possession.

​
Scope Attribute (2.x)

Scope attribute for FAPI2 MS Auth Req:

​
Service Configuration (2.x)

Configure your service as follows to comply with FAPI2 MS Auth Req (Authlete 2.3+). In Service Owner Console (so.authlete.com) the equivalent settings are under Basic, Authorization (grant types, response types, authorization endpoint, token endpoint, PAR endpoint, request object), Token, and Scope.

​
Client Configuration (2.x)

​
API Call Example (2.x)

The authorization server calls Authlete APIs in the same way as in 3.0. Example: when the client sends a valid PAR request with a signed request object and client assertion, the server forwards the parameters to /api/pushed_auth_req (or the 2.x equivalent endpoint). A successful response contains requestUri and responseContent (with expires_in and request_uri). For full request/response examples for /pushed_auth_req, /auth/authorization, /auth/authorization/issue, /auth/token, and /auth/introspection, see the FAPI 2.0 Message Signing – Signing Authorization Requests (3.0) page; the same flow and API usage apply to Authlete 2.x (2.3+).