Software Engineer, Identity Platform

OpenRouter

3d•$215,000 - $285,000

About The Position

OpenRouter is hiring its first Software Engineer, Identity Platform to build and own identity across its inference gateway, marketplace, and agentic products. The role defines how users, organizations, workspaces, apps, and agents authenticate; what they can access; and how access is delegated, governed, and revoked, from individual sign-in to enterprise identity-provider provisioning. The engineer will unify credentials and authentication methods under a common principal and authorization model; build delegated access for apps and agents; enable workload identity federation; create composable authorization; and deliver enterprise provisioning and SSO. The role also defines the core identity data model, protects users and customer data, and makes auditability, correctness, speed, and high availability core features of the identity system. The position works closely with Trust & Safety, Money, Product, Sales, and Customer Success on fraud and abuse, payment-linked verification and risk, onboarding, enterprise security reviews, and SSO rollouts.

Requirements

At least 5 years building production identity, authentication, or authorization systems at a SaaS, developer-platform, or security company.
Deep knowledge of OAuth 2.x, including PKCE, token exchange, and dynamic client registration; OIDC, SAML, SCIM, and JWTs, including practical failure modes.
Experience designing RBAC, ABAC, or ReBAC authorization models for multi-tenant B2B products, including migrating a live system from ad hoc checks to a unified model.
Hands-on experience integrating enterprise identity providers such as Okta, Entra ID, or Google Workspace, and an authentication platform such as Clerk, Auth0, WorkOS, or similar.
Strong TypeScript and SQL skills; comfort with Postgres and building low-latency, cache-heavy services on a critical request path.
A security mindset, including threat modeling, least-privilege design, and the ability to explain decisions to enterprise security reviewers.
Ability to work across teams and turn complex enterprise requests into clean systems.
High agency and an AI-forward approach, including daily use of coding agents and interest in automating manual security and onboarding work.

Nice To Haves

Shipped enterprise SSO and SCIM that passed customer security reviews.
Built workload identity federation or secretless authentication for CI and cloud workloads.
Built OAuth, consent, and delegation for AI agents or MCP clients acting on users’ behalf.
Experience with identity verification, KYC, or fraud and risk systems such as Stripe Identity, Persona, or Sift.
Experience with policy engines or fine-grained authorization, such as OpenFGA, Cedar, OPA, or Zanzibar-style systems.
Helped a company achieve SOC 2, ISO 27001, or similar compliance.
Existing OpenRouter user or experience building AI tooling projects.

Responsibilities

Unify API keys, management keys, browser sessions, OAuth and OIDC tokens, and MCP logins under a single principal and authorization model.
Own sign-in, MFA, passkeys, enterprise SSO using SAML and OIDC, and the lifecycle of credentials, including scoping, expiration, rotation, and revocation.
Build delegated access for apps and agents, including Sign in with OpenRouter, OAuth for MCP clients, dynamic client registration, and revocable consent grants.
Enable apps and agents to act on users’ behalf without handling secrets, and allow administrators to manage consent across organizations or workspaces.
Build workload identity federation so CI pipelines and cloud workloads can exchange identity-provider tokens for short-lived OpenRouter credentials, and enable internal services to authenticate without static secrets.
Develop a composable authorization model for organizations, workspaces, roles, automation keys, and future custom roles; enforce deny-by-default authorization on the server and reflect it in the UI.
Deliver enterprise provisioning, including SCIM user and group provisioning, group-to-role mapping, domain verification, self-service SSO, and programmatic provisioning for partner platforms.
Define the core identity model for users, organizations, workspaces, memberships, apps, and guardrails, with clear boundaries and ownership semantics.
Protect users and their data through identity fraud detection, KYC and verification flows, step-up checks, account-takeover defenses, abuse signals, and least-privilege access to customer data.
Ensure credentials have provenance, access decisions are explainable, privileged changes are logged, and authentication remains fast and highly available on the inference request path.
Partner with Trust & Safety, Money, Product, Sales, and Customer Success on fraud and abuse, payment-linked verification and risk, dashboard and onboarding experiences, enterprise security reviews, and SSO rollouts.
Use coding agents and automation to reduce manual security and onboarding work.