A testing ground for KSA fintech developers and license applicants. Build, test, and validate your FAPI 1.0 security stack — mTLS, JWT keys, and JWKS — before going live.
No credit card required · Free tier includes 3 certs + 2 keys.
FAPI 1.0 Advanced is the security profile mandated by SAMA for account information, payment initiation, and confirmation of funds APIs. This sandbox lets you build and validate your implementation before connecting to a live environment.
AIS — Live Now
TPPs can access account balances, transaction history, and statements with customer consent. Currently live under the KSA open finance framework.
PIS — Coming Soon
TPPs will be able to initiate payments directly from customer accounts, bypassing card networks for faster settlements.
CAF — Planned
Real-time confirmation that a customer has sufficient funds for a transaction — critical for e-commerce and lending.
The KSA FAPI profile mandates strong client authentication, signed request objects, and mTLS for every API call. WRVault covers the full stack — PKI infrastructure and a conformant OIDC authorization server.
Every API call between a TPP and the bank must be authenticated with a mutual TLS certificate. WRVault generates and manages these for you.
Request objects must be signed with RSA or ECDSA keys. WRVault hosts your public JWKS endpoint automatically.
FAPI 1.0 Advanced requires response_type=code id_token (hybrid flow). The auth server returns a detached ID token with c_hash, s_hash, and nonce alongside the authorization code.
Authorization requests must be pushed (PAR) before the browser redirect. PKCE S256 is mandatory — plain method is rejected.
Our authorization server passes all OpenID Foundation conformance tests for the FAPI 1.0 Advanced profile under the KSA plain response configuration. Certification pending fee payment.
mTLS sender-constrained tokens · Pushed Authorization Requests (PAR) · PKCE S256 · Hybrid flow (code + id_token)
View Conformance Results →Plan ID: cQpf0JfvNRzoE · certification.openid.net
From zero to a working FAPI 1.0 Advanced flow in your sandbox. Follow these steps before submitting your open finance license application.
Sign up at wrvault.com — free tier included. No credit card required.
Sign up →From your WRVault dashboard, issue an X.509 mTLS certificate. Note the Subject DN (e.g. CN=my-app,O=MyFintech,C=SA) — you will pass it as tls_client_auth_subject_dn in DCR. Alternatively, omit it to use TOFU: your cert is pinned automatically on your first authenticated call.
Generate an RSA or ECDSA key pair in WRVault. Your public JWKS endpoint is hosted automatically — copy its URL for the jwks_uri field in DCR.
POST to /connect/register with your client_name, redirect_uris, jwks_uri, tls_client_auth_subject_dn (from step 2), and contact_email. Leave profile as OB_KSA (default) for the FAPI 1.0 flow.
See DCR endpoint →Your registration starts as PENDING. Once an admin approves it, you receive an email at the contact_email you provided. Your client_id is then active.
Push an authorization request (PAR) with response_type=code id_token, complete the PSU consent flow, exchange the code for an access token using PKCE code_verifier, and call the AIS endpoints.
View API reference →Use these credentials at the authorize step — when the browser redirects to auth.wrvault.com/login. Each user has pre-seeded accounts, balances, and transactions.
2 accounts
james.harrisonTest@1234SA0380000000608010167519SA44200000012345678912341 account
emily.carterTest@1234SA55600000001234567801232 accounts
michael.brooksTest@1234SA7890000000987654321098SA2310000002468013579135These are synthetic test accounts. Passwords and data are reset on each deployment. Do not use real personal data in the sandbox.
Base URL: https://auth.wrvault.com
Showing KSA · FAPI 1.0 Advanced — endpoints marked FAPI 2.0 differ from the KSA profile.
mTLS endpoints — pass your certificate and key via --cert client.crt --key client.key in curl, or configure Postman Settings → Certificates for auth.wrvault.com.
WRVault gives KSA fintech developers a ready-made environment to build and validate their FAPI 1.0 security stack before submitting a license application.
Issue X.509 certificates for your sandbox TPP identity. Test mutual TLS handshakes against FAPI 1.0 endpoints before going live.
Create RSA/ECDSA key pairs, sign request objects, and verify JWT assertions — exactly as required by the KSA FAPI profile.
Each organization gets a hosted public JWKS URL. Register it during your license application to prove key management compliance.
Rotate signing keys on a schedule without downtime. Your JWKS endpoint updates instantly — no re-registration required.
Pull certificates and keys programmatically via REST API or GitHub Actions. Automate your FAPI 1.0 sandbox testing pipeline.
Get notified before sandbox or production certificates expire. Never fail a compliance check due to an expired cert.
We're building the complete FAPI 1.0 security stack in phases — aligned with the rollout of KSA open finance AIS, PIS, and CAF services.
AIS Ready
FAPI 1.0 Advanced
Full Stack
Sign up for free and start building your FAPI security stack today — KSA FAPI 1.0 or Canada FDX FAPI 2.0. No credit card, no commitment.
No credit card required · Free tier forever
Independent developer sandbox. Not affiliated with or endorsed by SAMA, FDX, the Bank of Canada, or any official open finance body.
© 2026 WRVault. All rights reserved.