Open standards with OpenID Connect fuels the open banking revolution

Open banking is rapidly changing how banks make information available to their customers. It is also accelerating the adoption of application programming interface (API) management tools to industrialize the deployment of public-facing APIs. My colleague Cheryl Chiodi recently wrote about the challenges and opportunities on meeting the directive by member financial organizations (you can read it here: Open Banking - How to Leverage Open APIs for Competitive Advantage in Financial Services). My post extends that discussion, focusing specifically on API security, and in particular the importance of open identity.

Let's take a concrete example: A third-party mobile application has been built that aggregates account balances from three banks into a single view for the customer. Surely the customer does not wish to authenticate themselves three times in order to access their information.

This problem can be addressed by establishing open identity standards so that APIs can be accessed in a federated fashion.  Importantly, this allows a customer to authenticate once through an established identity provider (IP). Once the customer is authenticated, relying parties (RPs), such as individual banks, are able to validate the identity without the customer logging in again.

The OpenID Foundation has created OpenID Connect, an interoperable authentication protocol, and the foundation is supported by the open banking directive Cheryl writes about in her recent post, and there is a shared objective by these two organizations to realize a secure mechanism to access bank information across API providers. It is another example where open communities and governance are allowing banks to participate in the wider Digital ecosystem.

Red Hat's 3Scale API management platform supports OpenID Connect as a security policy out of the box. This is an important capability so that a bank can allow its customers to have access to data openly and more securely.

Leading financial organizations that are seeking to maximize their reach with APIs will find that OpenID support can be a critical capability as they adapt their API platforms to support open banking.