My AI Agent Finally Has a Way to Ask Permission — Singpass CIBA on FAPI 2.0
Two weeks ago I was building a sheepdog control plane for my AI agents and hit a wall I couldn’t code around. My agents could authenticate — signed keys, handshakes, the whole dance. But the moment one of them needed to act on my behalf with real authority, there was no one to say yes. I couldn’t be the browser. Then I found out Singpass — the same app I’ve tapped to log into IRAS for years — had quietly built the exact mechanism for this, and it’s hiding inside an OAuth flow nobody talks about.
This post is me learning in public. I’m not an authority on FAPI 2.0 or CIBA — I’m a self-taught person who read the government’s developer docs and found the seam where national identity meets agentic AI.
The Wall: Agents Can’t Do the Redirect Dance
Every OAuth flow I know assumes a browser with a human attached. The user gets redirected, stares at a consent screen, taps Authorize, and the browser bounces back with a code.
Agents don’t work that way. They run in the background, they have no screen, and they can’t tap anything.
This is the authority grant problem from my sheepdog post, at national scale. An agent doesn’t need a passport saying who it is — it needs a grant saying what it’s allowed to do, backed by someone who actually has the authority to give it.
Singpass Is a Real API Platform
I assumed Singpass was a closed government app. Wrong. developer.singpass.gov.sg is a full developer portal — staging environments, test personas, sample apps, pricing. And it ships two products:
| Product | What it does | What you get |
|---|---|---|
| Singpass Login | OIDC authentication — prove who the user is | ID token, userinfo |
| MyInfo | Authorized data retrieval — pre-fill forms | Scoped data catalog |
The MyInfo catalog is the interesting one: CPF contribution history, Notice of Assessment, HDB property, driving licence, vehicle data, government schemes — all retrievable through a scoped API after the user consents. That’s a national identity layer acting as a data layer. My moat doc flagged exactly this seam between national digital ID and enterprise IAM — and it’s real.
FAPI 2.0: Bank-Grade by Decree
Here’s the part that made me sit up. Every Singpass API must be FAPI 2.0-compliant — the OpenID Foundation’s financial-grade security profile — by 31 December 2026. New apps have required it since February 2026.
That’s not hobbyist-grade OAuth. That’s the security bar banks use, and it’s now mandatory for touching national identity:
| Requirement | What it does | Why it matters for agents |
|---|---|---|
| PKCE | Proof Key for Code Exchange | Kills authorization-code interception |
| DPoP | Demonstrating Proof of Possession | Binds the token to the client’s key — a stolen token is useless |
| Client assertions | JWT-based client authentication | The client proves who it is with a key, not a shared secret |
| PAR | Pushed Authorization Requests | Rich structured requests without query-string bloat |
Notice what that stack is: the exact OAuth 2.1 / token-binding convergence my agentic-IAM research keeps landing on. Singapore isn’t following the trend — it’s mandating it. If you’re going to learn one OAuth profile for agent identity, FAPI 2.0 is the one with a regulator behind it.
CIBA: The Flow That Fits Agents
Buried in the integration docs is the finding that matters: CIBA — Client-Initiated Backchannel Authentication. It’s the OAuth flow designed for decoupled clients — a client that isn’t a browser, can’t redirect, and runs in the background.
The agent asks. Your phone approves. The agent gets scoped tokens. No browser redirect, no typed password, and the token is bound to the agent’s key via DPoP — so it can’t be replayed elsewhere.
This is the missing piece of my sheepdog architecture. I could build the authentication layer and the authorization layer — but consent from a real Singaporean citizen, backed by the state’s identity system, is the one thing I cannot self-host. CIBA is the bridge.
What This Means for the Sheepdog
My personal agent IAM now has a clear three-layer story:
The first two layers I’ve already built — BSV signed identity and a policy engine. The third is the one thing that has to come from outside: a citizen tapping approve on a national identity app. And the people who understand how to wire that integration — into statutory boards, banks, enterprises — are exactly the kind of engineers I want to become.
What I Still Don’t Know
Learning in public means saying what I haven’t figured out yet. I haven’t run a CIBA handshake against Singpass’s staging environment. I haven’t tested whether refresh tokens survive long-running agent sessions, or how DPoP key rotation works across a fleet of sub-agents. The docs mention step-up authentication — re-confirming consent for high-risk actions — but I haven’t mapped when Singpass forces a fresh push.
That’s the honest state: I understand the architecture, and I haven’t touched the implementation. The next step is a staging-environment demo — a small agent that requests MyInfo scope and waits for a push on my phone.
The Takeaway
The future isn’t agents with passports — it’s agents with authority grants, and Singpass CIBA is the first national-scale version of that grant. One sentence I can now say that almost nobody in Singapore can: CIBA on FAPI 2.0 is how an agent asks, a phone approves, and the state asserts the consent. That’s worth a lot more than another row of button-clicking.