[Action Required] Migrate to Corppass FAPI 2.0 Production Environment by 2027-03-31

Dear Partners,

As part of our ongoing commitment to strengthen security standards and align with global security best practices, Corppass is adopting Financial-grade API (FAPI) 2.0 for all APIs.

Following the rollout of the Corppass FAPI 2.0 staging environment on 23 February 2026, we are pleased to announce that the Corppass FAPI 2.0 production environment is now available.

What you need to know:

• Mandatory Compliance: All new apps created on the Corppass Developer Portal (CDP) from 23 March 2026 will be FAPI 2.0 compliant. All older Corppass e-services must be fully migrated to FAPI 2.0 by 31 March 2027.
• Privacy enhancements to Corppass Login apps:
  • Added security via PAR (Pushed Authorisation Requests): Authorisation parameters are now sent securely server-to-server before redirecting users, reducing tampering risks, eliminating large URL payloads, and significantly strengthening the platform's financial-grade security posture.
  • Modernised Token Structure: FAPI 2.0 replaces the legacy flat token with a clean hierarchical format - separating the subject (sub), profile attributes (sub_attributes), and actor info (act) to clearly identify entity vs acting user.
  • More Granular Scopes: New fine-grained scopes (e.g., entity.identity, user.name) provide partners with precise control over identity data requests.
  • Standardised Userinfo Endpoints: The old /authorization-info API has been replaced by the OIDC-standard /userinfo endpoint, accessed with a DPoP-bound access token.
• Engagement Session: Technical briefing with Q&A will be held on 31 March 2026 to support you in your migration. The briefing materials will be shared after the session.

What you need to do:

1. Review Documentation: Refer to the Corppass FAPI 2.0 Integration Guide and Migration Guide to review the relevant technical information.
2. Submit Migration Timeline & RSVP: Please use this link to indicate your planned migration window for FAPI 2.0 and register for the virtual technical briefing.
   • Date/Time: 31 March 2026, 10am – 12pm (Singpass and Corppass FAPI 2.0)
   • Note: Even if you are unable to attend, please complete the form to indicate your migration timeline.
3. Commence Migration: Start migrating your existing apps to ensure they are FAPI 2.0 compliant. 

Timeline Summary

Thank you for your continued partnership in strengthening security and trust across all digital services. If you have any questions, please reach out to our support team here.

Best regards,

Corppass team