Skip to main content
Once you are ready to bring in third party developers you will need to register them as Clients with your Data Provider. How you do this depends on the industry and jurisdiction you operate in.
  • CDR: Client onboarding is done through the OAuth 2.0 Dynamic Client Registration Protocol. Any accredited data recipient can register directly with your Data Provider instance over API.
  • FDX: FDX client onboarding is managed through Plaid. By adding Plaid as a client you gain access to their vast network of partners.
  • Other: If you are running a plain FAPI 2.0 Data Provider in another jurisdiction you must onboard clients manually in the Fiskil Console

​
Onboarding clients in the Fiskil Console

If you operate a plain FAPI 2.0 Data Provider you’ll need to manually add clients in the Fiskil Console. There are two steps to this process.

​
Registering the client

FAPI 2.0 Data Providers use the private_key_jwt OIDC Client Authentication method. This is one of the methods accepted by the FAPI 2.0 standard. Clients must pre-register a public key that can be used to verify JWT assertions they make as part of client authentication. Follow the steps below from the Client Registration menu.
  1. Click “Add New Client”
  2. Fill out the form
    • Client Name: A human-readable name for the client. This will be presented to your users during the consent flow
    • JWKS URI The clients JWKS URI. Must be HTTPS. This URL points to the public key the client uses for Private Key JWT Client Authentication and pushed authorization request objects
    • Brand Image A logo for the client. This will be presented to end users during the consent flow.
  3. Confirm by clicking “Add Client”

​
Issuing client certificates

FAPI 2.0 Data Providers use mTLS as an additional transport security measure and as a mechanism for supporting sender-constrained access tokens as defined in RFC 8705. The mTLS certificates are issued by Fiskil’s private FAPI 2.0 certificate authority. The steps to get a mTLS client certificate for a new client are:
  1. Ask your client to send you a Certificate Signing Request (CSR) from your client in PEM encoded DER format
  2. On the Client Registration menu, find the client in the table
  3. Click the Actions menu for the client’s row and select “Manage Certificates”
  4. Click Create Certificate in the newly opened dialog
  5. Paste the CSR in the text area and click Create
  6. Copy the Certificate and the Certificate Chain from the result dialog and send both to your client. Note they only need to present the leaf certificate in order to establish a connection with your Data Provider’s mTLS endpoint
If your client needs assistance generating a CSR, they can use the below snippet to create a CSR and private key in one:
Have them send client.csr to you. Make sure they keep the client.key file private and save it somewhere safe as this is the private key they must use with the issued certificate