--- title: Germany Built the API Authorization Blueprint the Rest... description: Germany's FITKO and Saxony-Anhalt have built an open-source federal API authorization infrastructure (Föderale API-Autorisierungsinfrastruktur) that... canonical: https://daily.dev/posts/germany-built-the-api-authorization-blueprint-the-rest-of-government-needs-6zyqh6i0w twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Germany Built the API Authorization Blueprint the Rest of Government Needs | daily.dev og:description: Germany's FITKO and Saxony-Anhalt have built an open-source federal API authorization infrastructure (Föderale API-Autorisierungsinfrastruktur) that... og:url: https://daily.dev/posts/germany-built-the-api-authorization-blueprint-the-rest-of-government-needs-6zyqh6i0w og:image: https://api.daily.dev/og/posts/6ZyQH6I0w.png og:image:alt: Germany Built the API Authorization Blueprint the Rest of Government Needs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Germany Built the API Authorization Blueprint the Rest of Government Needs **[API Evangelist](https://daily.dev/sources/apievangelist)** · 5 min read · 6 upvotes · 1 comments ## Summary Germany's FITKO and Saxony-Anhalt have built an open-source federal API authorization infrastructure (Föderale API-Autorisierungsinfrastruktur) that standardizes machine-to-machine API authorization across all sixteen German states and the federal government. Rather than inventing new schemes, the architecture profiles existing standards — OAuth 2.1, FAPI 2.0, DPoP token binding, dynamic client registration, OpenID AuthZEN, transparency logs, and Shared Signals — into a single, uniformly applied baseline. The IT Planning Council formally approved it for continuation into piloting in June 2026, with all deliverables published MIT-licensed on Open CoDE. The author argues this is the most complete, standards-first blueprint for federated API authorization in the public sector and plans a series breaking it down for US and European agencies to adopt. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What standards did Germany combine to build its federal API authorization infrastructure? Germany's Föderale API-Autorisierungsinfrastruktur combines OAuth 2.1 with the FAPI 2.0 security profile layered on top, DPoP for token binding, dynamic client registration with signed software statements for onboarding, OpenID AuthZEN between enforcement and decision points, a transparency log for tamper-evidence, and Shared Signals for continuous risk detection, applied uniformly across the whole federation rather than per-service. _Architects standardizing government API security can track blueprints like this one on daily.dev._ ### When was Germany's federal API authorization infrastructure approved and what happens next? Germany's IT Planning Council formally approved the Föderale API-Autorisierungsinfrastruktur for continuation on June 17th, 2026, moving it into piloting along with a working group tasked with making its security requirements binding. It was built by a joint initiative of the state of Saxony-Anhalt and FITKO, the Federal IT Cooperation coordinating all sixteen German states plus the federal government. _Follow governance milestones like this one on daily.dev if you track API authorization standards adoption._ ### Where can I find Germany's federal API authorization architecture documentation and is it open source? Every deliverable, including the target architecture, security profiles, glossary, and twenty-three architecture decision records, is published as open source and MIT-licensed on Open CoDE, a GitLab instance at gitlab.opencode.de under the sachsen-anhalt/mid namespace. This makes the full reasoning behind each standards choice reusable by other governments or organizations facing the same authorization problem. _Developers reusing government-grade authorization patterns can find sources like this via daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@pdfopsdev** · 0 upvotes > DPoP token binding across sixteen states' worth of independent implementations is the part I'd bet regresses first. sender-constrained tokens are great in theory but every client SDK handles the proof-of-possession header slightly differently, and clock-skew on the DPoP jti/iat check is a classic source of mystery 401s at scale. ## Similar posts on daily.dev - [A Playbook for US Agencies: Emulating Germany's API Authorization Approach](https://daily.dev/posts/a-playbook-for-us-agencies-emulating-germany-s-api-authorization-approach-farh4bldr) · API Evangelist · 0 upvotes · 0 comments - [A Playbook for Europe: eIDAS, Sovereignty, and a Shared GovTech Ecosystem](https://daily.dev/posts/a-playbook-for-europe-eidas-sovereignty-and-a-shared-govtech-ecosystem-iipiflfhd) · API Evangelist · 0 upvotes · 0 comments - [Profile, Don't Invent: How Germany Chose OAuth 2.1 and FAPI 2.0](https://daily.dev/posts/profile-don-t-invent-how-germany-chose-oauth-2-1-and-fapi-2-0-qoirligjb) · API Evangelist · 0 upvotes · 0 comments --- Tags: [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/germany-built-the-api-authorization-blueprint-the-rest-of-government-needs-6zyqh6i0w) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Germany Built the API Authorization Blueprint the Rest of Government Needs","url":"https://daily.dev/posts/germany-built-the-api-authorization-blueprint-the-rest-of-government-needs-6zyqh6i0w","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/germany-built-the-api-authorization-blueprint-the-rest-of-government-needs-6zyqh6i0w"},"datePublished":"2026-07-16T12:42:11.469Z","dateModified":"2026-09-14T08:45:00.452Z","description":"Germany's FITKO and Saxony-Anhalt have built an open-source federal API authorization infrastructure (Föderale API-Autorisierungsinfrastruktur) that...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b258ed517ea82ac594d277f0472aa7f1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b258ed517ea82ac594d277f0472aa7f1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"API Evangelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"API Evangelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a36244ae67bc4f41a605f780267ecb5f","url":"https://daily.dev/sources/apievangelist"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/germany-built-the-api-authorization-blueprint-the-rest-of-government-needs-6zyqh6i0w","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":6},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"oauth","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"API Evangelist","item":"https://daily.dev/sources/apievangelist"},{"@type":"ListItem","position":3,"name":"Germany Built the API Authorization Blueprint the Rest of Government Needs"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/germany-built-the-api-authorization-blueprint-the-rest-of-government-needs-6zyqh6i0w","comment":[{"@type":"Comment","text":"DPoP token binding across sixteen states’ worth of independent implementations is the part I’d bet regresses first. sender-constrained tokens are great in theory but every client SDK handles the proof-of-possession header slightly differently, and clock-skew on the DPoP jti/iat check is a classic source of mystery 401s at scale.","datePublished":"2026-07-17T18:04:42.052Z","url":"https://daily.dev/posts/6ZyQH6I0w#c-yS9IC6XR2","author":{"@type":"Person","name":"PDFops","url":"https://daily.dev/pdfopsdev","image":"https://media.daily.dev/image/upload/s---8isRBKc--/f_auto/v1782922291/avatars/avatar_orjMeK8QKaaVZwGq7ScPz?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/germany-built-the-api-authorization-blueprint-the-rest-of-government-needs-6zyqh6i0w#faq","mainEntity":[{"@type":"Question","name":"What standards did Germany combine to build its federal API authorization infrastructure?","acceptedAnswer":{"@type":"Answer","text":"Germany's Föderale API-Autorisierungsinfrastruktur combines OAuth 2.1 with the FAPI 2.0 security profile layered on top, DPoP for token binding, dynamic client registration with signed software statements for onboarding, OpenID AuthZEN between enforcement and decision points, a transparency log for tamper-evidence, and Shared Signals for continuous risk detection, applied uniformly across the whole federation rather than per-service. Architects standardizing government API security can track blueprints like this one on daily.dev."}},{"@type":"Question","name":"When was Germany's federal API authorization infrastructure approved and what happens next?","acceptedAnswer":{"@type":"Answer","text":"Germany's IT Planning Council formally approved the Föderale API-Autorisierungsinfrastruktur for continuation on June 17th, 2026, moving it into piloting along with a working group tasked with making its security requirements binding. It was built by a joint initiative of the state of Saxony-Anhalt and FITKO, the Federal IT Cooperation coordinating all sixteen German states plus the federal government. Follow governance milestones like this one on daily.dev if you track API authorization standards adoption."}},{"@type":"Question","name":"Where can I find Germany's federal API authorization architecture documentation and is it open source?","acceptedAnswer":{"@type":"Answer","text":"Every deliverable, including the target architecture, security profiles, glossary, and twenty-three architecture decision records, is published as open source and MIT-licensed on Open CoDE, a GitLab instance at gitlab.opencode.de under the sachsen-anhalt/mid namespace. This makes the full reasoning behind each standards choice reusable by other governments or organizations facing the same authorization problem. Developers reusing government-grade authorization patterns can find sources like this via daily.dev."}}]} ```