Software Engineer, Identity Platform
OpenRouter1 day ago
Remote, United StatesSenior
Base Salary
$215k - $285k/yr
Responsibilities
- Unify API keys, management keys, browser sessions, OAuth and OIDC tokens, and MCP logins under a common identity and authorization model.
- Build authentication features including sign-in, MFA, passkeys, enterprise SSO, credential lifecycle management, and revocation.
- Develop delegated access, OAuth flows, dynamic client registration, consent grants, and identity capabilities for apps and AI agents.
- Implement workload identity federation and short-lived, secretless credentials for CI pipelines, cloud workloads, and internal services.
- Design composable, fine-grained authorization for organizations, workspaces, users, apps, agents, roles, and permissions.
- Build enterprise provisioning with SCIM, group-to-role mapping, domain verification, SSO integrations, and partner account provisioning.
- Define the core identity data model and protect users through fraud detection, KYC, verification, step-up checks, and account-takeover defenses.
- Ensure credential provenance, explainable access decisions, audit logging, high availability, and low latency on the inference request path.
- Collaborate with Trust & Safety, Money, Product, Sales, and Customer Success on fraud prevention, verification, onboarding, and enterprise security reviews.
Requirements
- 5+ years of experience building production identity, authentication, or authorization systems at a SaaS, developer-platform, or security company.
- Deep fluency with OAuth 2.x, PKCE, token exchange, dynamic client registration, OIDC, SAML, SCIM, and JWTs.
- Experience designing RBAC, ABAC, or ReBAC authorization models for multi-tenant B2B products and migrating live systems to unified authorization.
- Hands-on experience integrating Okta, Entra ID, Google Workspace, and an authentication platform such as Clerk, Auth0, or WorkOS.
- Strong TypeScript and SQL skills, with experience using Postgres and building low-latency, cache-heavy services on critical request paths.
- Ability to apply threat modeling and least-privilege principles and communicate decisions to enterprise security reviewers.
- Preferred experience shipping enterprise SSO and SCIM, workload identity federation, secretless authentication, OAuth delegation for AI agents or MCP clients, identity verification, KYC, fraud and risk systems, policy engines, and compliance programs.
- Preferred familiarity with Stripe Identity, Persona, Sift, OpenFGA, Cedar, OPA, Zanzibar-style systems, or AI tooling.
- High agency, cross-functional collaboration skills, and regular use of coding agents and automation.
Tech Stack
Categories
About OpenRouter
OpenRouter builds a unified API and routing layer that lets developers and enterprises access, compare, and manage large language models across multiple providers, with tooling for chat, evals, and usage controls. The company monetizes through metered API usage and enterprise plans that add governance and reliability features. Founded in 2023 and headquartered in New York, it supports hundreds of third-party models and an active developer community on Discord.