Software Engineer, Identity Platform
AI model gateway and marketplace offering a unified API to access, route, and manage models from multiple providers.
Funding history
Projects
About OpenRouter
OpenRouter provides developers and businesses with a single, OpenAI-compatible API for hundreds of AI models. It supports provider failover, routing for price, latency and reliability, plus enterprise controls and observability.
Skills
Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You will build and own the identity platform across the inference gateway, marketplace, and agentic products. You will unify authentication and authorization, develop delegated and workload identity flows, enable enterprise provisioning, define core identity data models, and protect users through auditable, highly available security systems.
Requirements
- 5+ years building production identity, authentication, or authorization systems at a SaaS, developer-platform, or security company.
- Fluency in OAuth 2.x, PKCE, token exchange, dynamic client registration, OIDC, SAML, SCIM, and JWTs.
- Experience designing RBAC, ABAC, or ReBAC authorization models for multi-tenant B2B products.
- Experience integrating enterprise identity providers and an authentication platform.
- Strong TypeScript and SQL skills.
- Experience with Postgres and low-latency, cache-heavy services.
- Security mindset with threat modeling and least-privilege design.
- Ability to collaborate across teams and translate enterprise requirements into systems.
- Experience using coding agents and automating security and onboarding work.
Responsibilities
- Unify authentication across API keys, sessions, OAuth, OIDC tokens, and MCP logins.
- Own sign-in, MFA, passkeys, enterprise SSO, and credential lifecycle management.
- Build delegated access and OAuth consent flows for applications and agents.
- Develop secretless workload identity federation for CI pipelines, cloud workloads, and internal services.
- Build a composable authorization model with server-enforced least-privilege access.
- Implement SCIM provisioning, group-to-role mapping, domain verification, and self-service SSO.
- Define identity models for users, organizations, workspaces, memberships, applications, and guardrails.
- Develop fraud detection, KYC, verification, step-up checks, and account-takeover defenses.
- Ensure credential provenance, explainable access decisions, audit logs, and highly available authorization.
- Partner with Trust & Safety, Money, Product, Sales, and Customer Success stakeholders.
Benefits
- Equity