# OAuth 2.0 with FAPI 2.0 Is Now Available on Mastercard Developers
source: https://developer.mastercard.com/blog/fapi-20-is-now-available-on-mastercard-developers/index.md

Authors: Jean-Alexis Aufauvre, Muhammad Azeem. TL;DR Mastercard now supports OAuth 2.0 with FAPI 2.0 (Financial-Grade API) FAPI 2.0 is a security profile on top of OAuth 2.0, designed for high-security API scenarios OAuth 2.0 with FAPI 2.0 will be rolled out progressively across the Mastercard API portfolio Your existing OAuth 1.0a credentials can be used with OAuth 2.0 after a one-time project upgrade We started releasing open-source OAuth 2.0 client libraries, and testing tools like Insomnia to accelerate OAuth 2.0 integration What Is FAPI 2.0? FAPI 2.0 is a security profile built on top of OAuth 2.0, created by the OpenID Foundation for financial services and other industries that need stronger security. In the context of Mastercard APIs, the authentication flow used is the client credentials flow. If you're familiar with OAuth 1.0a, this one works differently. OAuth 1.0a uses one-legged authentication (each API request is signed individually, with no token involved). With OAuth 2.0, your application first requests an access token from the Mastercard authorization server, then uses that token for subsequent API requests. FAPI 2.0 adds two security requirements on top of standard OAuth 2.0: strong client authentication and token binding. With strong client authentication, your application signs a client assertion with a private key to prove its identity when requesting access tokens. With token binding, access tokens are bound to your application using DPoP (Demonstrating Proof of Possession), so stolen tokens can't be reused by someone else. Upgrading From OAuth 1.0a If you use OAuth 1.0a and APIs in your Mastercard Developers project are enabled for OAuth 2.0, then you can upgrade your project to use both authentication methods. To do that, log into your Mastercard Developers dashboard, navigate to your project, and click "Upgrade to OAuth 2.0". All existing and future keys in the project will then support both OAuth 1.0a and OAuth 2.0. APIs that support FAPI 2.0 will have their documentation updated to mention it. If you don't see "Upgrade to OAuth 2.0", it means OAuth 1.0a is still the way to go for APIs in your project. OAuth 1.0a stays fully supported, so you can migrate when it suits you. Developer Tools and Client Libraries Mastercard is releasing open-source client libraries that take care of the OAuth 2.0 authentication for you: they manage access tokens and attach DPoP proofs to each request automatically. You can find those new libraries under the Mastercard organization, on GitHub. They follow the same philosophy as the existing libraries for OAuth 1.0a: small, focused on a single responsibility, and easy to plug into your HTTP client of choice. We also updated our plugin for Insomnia to support FAPI 2.0, so you can test OAuth 2.0-enabled APIs directly from Insomnia. Other developer tools are on the way. APIs Getting OAuth 2.0 Support OAuth 2.0 with FAPI 2.0 will be rolled out progressively across the Mastercard API portfolio. As APIs are enabled, their documentation will be updated accordingly, and you'll see the "Upgrade to OAuth 2.0" option appear in your project dashboard. Stay tuned for announcements as support goes live. Next Steps For a step-by-step walkthrough, see Using OAuth 2.0 to Access Mastercard APIs. If you have questions, or if you're using a Mastercard API that doesn't yet support OAuth 2.0 and you'd like it to, reach out through our Support page.