A testing ground for Canadian fintech developers building to the FDX API standard. Validate your FAPI 2.0 security stack — mTLS, PAR, PKCE S256, and JARM JWT responses — ahead of the Bank of Canada open banking rollout.
No credit card required · Free tier includes 3 certs + 2 keys.
Canada's Consumer-Driven Banking (CDB) framework uses the FDX API standard with FAPI 2.0 as the security layer. The Bank of Canada oversees accreditation. Phase 1 targets read-only account data; Phase 2 adds payment initiation (~2027).
AIS — Phase 1 (targeted 2026)
Read-only access to account details, balances, and transactions. The first phase of Canada's Consumer-Driven Banking rollout, currently in regulatory preparation.
PIS — Phase 2 (~2027)
Write access for payment initiation, aligned with the Real-Time Rail (RTR) launch. Targeted for Phase 2 of the Bank of Canada framework.
CDBA Consumer Rights
The Consumer-Driven Banking Act mandates granular consent controls, revocation rights, and data portability for Canadian consumers.
Canada's FDX standard uses FAPI 2.0 as its security layer. The core changes from FAPI 1.0 are a pure code flow (no hybrid), mandatory JARM for JWT-secured authorization responses, and stricter PKCE enforcement.
Same as FAPI 1.0 — every API call requires a mutual TLS certificate. Sender-constrained tokens are bound to the certificate thumbprint.
In FAPI 2.0, PAR is mandatory (not optional) and PKCE S256 replaces JAR as the primary request integrity mechanism. Plain PKCE and inline request parameters are rejected.
FAPI 2.0 drops the hybrid flow entirely. response_type must be code only. FDX_CA clients that send response_type=code id_token are rejected at the PAR endpoint.
response_mode=jwt is required for FDX_CA clients. The authorization response (code + state) is wrapped in a PS256-signed JWT and returned as ?response= on the redirect URI.
Our authorization server passes all OpenID Foundation conformance tests for the FAPI 2.0 Security Profile Final under the plain FAPI configuration with mTLS sender-constraining.
mTLS sender-constrained tokens · PAR mandatory · PKCE S256 · Pure code flow · Refresh token support
View Conformance Results →Plan ID: RTZJ7f6CulzxT · certification.openid.net
From zero to a working FAPI 2.0 flow in your sandbox. Follow these steps before connecting to Canadian open banking infrastructure.
Sign up at wrvault.com — free tier included. No credit card required.
Sign up →From your WRVault dashboard, issue an X.509 mTLS certificate. Note the Subject DN (e.g. CN=my-app,O=MyFintech,C=SA) — you will pass it as tls_client_auth_subject_dn in DCR. Alternatively, omit it to use TOFU: your cert is pinned automatically on your first authenticated call.
Generate an RSA or ECDSA key pair in WRVault. Your public JWKS endpoint is hosted automatically — copy its URL for the jwks_uri field in DCR.
POST to /connect/register with your client_name, redirect_uris, jwks_uri, tls_client_auth_subject_dn, contact_email, and profile: "FDX_CA". This enables FAPI 2.0 enforcement — the server will require response_type=code and response_mode=jwt on all PAR requests.
See DCR endpoint →Your registration starts as PENDING. Once an admin approves it, you receive an email at the contact_email you provided. Your client_id is then active.
Push an authorization request (PAR) with response_type=code and response_mode=jwt, complete the PSU consent flow, extract the code from the JARM JWT response (?response=), exchange it for an access token, and call the FDX API endpoints.
View API reference →Use these credentials at the authorize step — when the browser redirects to auth.wrvault.com/login. Each user has pre-seeded accounts, balances, and transactions.
2 accounts
james.harrisonTest@1234SA0380000000608010167519SA44200000012345678912341 account
emily.carterTest@1234SA55600000001234567801232 accounts
michael.brooksTest@1234SA7890000000987654321098SA2310000002468013579135These are synthetic test accounts. Passwords and data are reset on each deployment. Do not use real personal data in the sandbox.
Base URL: https://auth.wrvault.com
Showing Canada · FDX + FAPI 2.0 — endpoints marked FAPI 2.0 differ from the KSA profile.
mTLS endpoints — pass your certificate and key via --cert client.crt --key client.key in curl, or configure Postman Settings → Certificates for auth.wrvault.com.
WRVault gives Canadian fintech developers a ready-made environment to build and validate their FAPI 2.0 security stack ahead of the Bank of Canada open banking rollout.
Issue X.509 certificates for your sandbox TPP identity. Test mutual TLS handshakes against FAPI 2.0 endpoints with sender-constrained tokens.
Create RSA/ECDSA key pairs, sign PAR request objects, and verify JARM authorization response JWTs — as required by the FDX FAPI 2.0 profile.
Each organization gets a hosted public JWKS URL. Register it via DCR with profile=FDX_CA to activate FAPI 2.0 enforcement.
Rotate signing keys on a schedule without downtime. Your JWKS endpoint updates instantly — no re-registration required.
Pull certificates and keys programmatically via REST API or GitHub Actions. Automate your FAPI 2.0 sandbox testing pipeline.
Get notified before sandbox or production certificates expire. Never fail a Bank of Canada compliance check due to an expired cert.
Building the FAPI 2.0 stack for Canada's FDX open banking framework — aligned with the Bank of Canada accreditation timeline and the FDX v6 API standard.
mTLS + JWKS
FDX_CA Profile
Bank of Canada Ready
Sign up for free and start building your FAPI security stack today — KSA FAPI 1.0 or Canada FDX FAPI 2.0. No credit card, no commitment.
No credit card required · Free tier forever
Independent developer sandbox. Not affiliated with or endorsed by SAMA, FDX, the Bank of Canada, or any official open finance body.
© 2026 WRVault. All rights reserved.