Security Challenges in the World's Largest Open Finance Ecosystem
summary
Brazil’s open finance ecosystem reports 20 billion API calls since 2022, 27 million consents, 500,000 payments and over 800 registered institutions, and runs on cloud infrastructure (AWS) with Pix instant payments. Security moves from basic auth and API keys to OAuth2/OpenID Connect hardened by FAPI 2.0 (MTLS, PKCE, PAR/JAR, signed/encrypted tokens) and passwordless device-bound keys via FIDO2 (private/public key pairs). A deployed use case keeps checkout on the merchant site, uses nonce and ~30–40 risk signals, and removes redirect-based authentication.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:31Open Finance in Brazil
- 7:57Security challenges in APIs
- 9:04Authentication and authorization evolution
- 15:17FAPI framework benefits
- 21:31Seamless secure payments use case
- 26:42FIDO2 for frictionless auth
- 31:02Secure journeys benefits
- 32:52FAPI and FIDO2 integration
- 34:24Cybersecurity testing and compliance
- 34:50Q&A
related talks
25mOpen Finance: Future is Open
18mSecure your Apps and APIs with strong authentication and Adaptive Access.
24mAPI Security in Open Banking Context
27mDriving revenue opportunities across the Open Banking ecosystem
37mOpenID Foundation Strategy
31mOpen Banking is Here to Stay: How Will You Benefit from It?
32mEnhancing Security, Reliability, and Global Scalability in FinTech
26mReimagining the Banking Core: APIs as the Digital Fabric of Transformation