Open Finance Brazil: How to run conformance tests for FAPI-CIBA OPs

This guide explains how to configure and run the Open Finance Brazil FAPI-CIBA tests for an OpenID Provider (OP), also called an authorization server. The conformance suite acts as the client and tests your server. The steps below use Ping mode, Private Key JWT client authentication, and two pre-registered clients.

How the test works

A successful CIBA flow follows these main steps:

1. Read the server metadata and keys. The suite retrieves your OP’s discovery document and JWKS, then checks the advertised capabilities.
2. Create a consent. The suite obtains an access token using the client_credentials grant and calls the consent endpoint. It keeps the returned consent ID for the authentication request.
3. Call the backchannel authentication endpoint. The suite sends a signed CIBA request over mTLS, using the consent ID as login_hint and including the consent ID in the requested scope. The OP returns an auth_req_id.
4. Authenticate the user and obtain approval. The user completes authentication and approves the request through the OP’s authentication device or application. Follow the instructions shown by the test.
5. Wait for the ping. The OP sends a notification to the suite’s registered notification endpoint over mTLS. The suite checks the notification token and auth_req_id. The ping signals that the result is ready; it does not contain the tokens.
6. Obtain the tokens. After the ping, the suite calls the token endpoint with the CIBA grant and the auth_req_id, then validates the response and ID token.
7. Call the protected resource. The suite uses the access token and the client’s mTLS certificate to call the resource endpoint and check the response.

1. Select the test plan

1. Open the OpenID Foundation conformance suite and sign in with Google or GitLab.
2. On My Test Plans, select Create a new test.
3. Keep Guided selected, then choose OpenFinance Brazil, OP (Authorization Server), and CIBA.
4. Check that the review screen shows the following plan and settings.

Setting	Value
Test plan	FAPI-CIBA-ID1: Authorization server test
Client Authentication Type	Private Key JWT
FAPI CIBA Profile	Open Finance Brazil
CIBA Mode	Ping
Client Registration Type	Static (pre-registered) client

Select Configure this plan to open the configuration form.

2. Prepare the configuration

The guided path above uses two clients that are already registered with your OP. Use the Form tab to enter individual values, or the JSON tab to paste a complete configuration.

Example configuration: Open the preconfigured OP example plan (private link). Select View configuration to inspect the values used for this equivalent test. The link provides access to the shared example plan and its results; create your own plan to test your deployment.

The shared configuration demonstrates the single-client scope-order test. Before running the two-client test, also supply the second client’s private encryption key in Second client → jwks and register its public key with your OP.

The values below are examples. Replace the endpoints, client IDs, keys, certificates, and user identifiers with values for your test environment.

Form section	Information to provide	Example values or guidance
Test information	A unique, URL-safe alias and a description. Keep publish set to No while checking the setup.	alias: documentation-alias-OP description: OFB-YOUR_OFB_IDENTIFIER_HERE_OP Choose your own alias to avoid clashes with other testers.
Server	The full discoveryUrl, including .well-known/openid-configuration.	https://op.example.org/.well-known/openid-configuration Use the discovery URL for your OP.
Client	The first client’s client_id, scope, and private signing and encryption keys in jwks format.	client_id: ofb-ciba-client-1 scope: openid consents resources Include a private signing key with alg: PS256 and a separate private RSA encryption key with use: enc and alg: RSA-OAEP. Register the corresponding public keys with your OP.
TLS certificates for client	The first client’s mTLS certificate and matching private key. Include the CA chain if required.	Supply mtls.cert and mtls.key in PEM format. Use the certificate registered for this client. mtls.ca contains any required CA chain.
Second client	The second client’s client_id, scope, and private signing and encryption keys in jwks format. Use a different signing key from the first client.	client_id: ofb-ciba-client-2 scope: openid consents resources This is a separate client registration used by the two-client tests. Include an RSA encryption key with use: enc and alg: RSA-OAEP, and register its public key with your OP.
Second client TLS certificates	The second client’s mTLS certificate and matching private key, plus the CA chain if required.	Supply mtls2.cert and mtls2.key for the second client. Add mtls2.ca if required.
Resource	The resourceUrl, consentUrl, test-user brazilCpf and/or brazilCnpj, and Business or Personal Products selection.	resourceUrl: https://rs.example.org/open-banking/resources/v3/resources consentUrl: https://rs.example.org/open-banking/consents/v3/consents Use identifiers for a test user known to your OP. Select personal for a personal-product scenario.
Directory	The Directory keystore base for the environment under test.	For the directory sandbox: https://keystore.sandbox.directory.openbankingbrasil.org.br/

Note: Supply signing keys, encryption keys, and mTLS certificates and keys for both clients, even when the client authentication method is Private Key JWT. Configure your OP to issue ID tokens encrypted with RSA-OAEP and A256GCM for both clients.

Note: Brazil CIBA maximum expiry sets the maximum approval period, in seconds, for the product or service under test. If left empty, the suite uses 86400 seconds as a ceiling and permits a lower product-specific expires_in value.

Register the ping callback: Configure both clients at your OP to use the suite’s notification endpoint. With the example alias documentation-alias-OP, the production callback is:

https://mtls-www.certification.openid.net/test-mtls/a/documentation-alias-OP/ciba-notification-endpoint

Use your own alias in this URL and check it against the notification endpoint shown by the suite. The OP must be able to reach this endpoint and send the ping over mTLS.

3. Create the plan and run the initial tests

1. Select Validate Configuration and correct any configuration errors.
2. Select Create test plan. The plan page lists the tests that apply to your selected profile and settings.
3. Run fapi-ciba-id1-brazil-discovery-end-point-verification first and inspect its result.
4. Select Run Test for FAPI-CIBA-ID1: Ensure other scope order succeeds (fapi-ciba-id1-ensure-other-scope-order-succeeds) to exercise the flow described above. Follow the instructions in the live test log and complete user authentication and approval at your OP.
5. Check that the test receives the ping, obtains tokens, calls the resource endpoint, and reaches FINISHED. Review the result as well as the execution status.
6. Return to the plan and run FAPI-CIBA-ID1: Two client test (fapi-ciba-id1) to check both client registrations. Complete the requested actions for each client.

4. Review the results and complete the plan

Open any warning or failure in the test log to see the condition, request or response details, and specification references. Correct configuration or implementation problems, then run the affected test again. A test marked FINISHED has stopped running; check whether its result is PASSED, WARNING, or FAILED.

Continue through all applicable tests in the plan. Some scenarios require rejection, expiry, or other actions instead of approval; follow each test’s instructions. Completing the example flow confirms the initial setup, but certification requires the complete applicable test plan and the OpenID Foundation certification submission process.