Software Engineer, Identity Platform

Compensation

$215K – $285K • Offers Equity

About OpenRouter

OpenRouter is the leading AI routing and infrastructure layer that enterprises use to access, manage, and optimize the best large language models across providers,without lock-in, capacity constraints, or unnecessary cost.

About the Role

Every request that flows through OpenRouter starts with a question: who is this, and what are they allowed to do? Millions of developers, thousands of organizations and a growing fleet of autonomous agents reach us through API keys, browser sessions, OAuth apps, MCP clients and federated cloud workloads.

We're hiring our first Software Engineer, Identity Platform to envision, build and own identity across OpenRouter's inference gateway, marketplace and rapidly growing suite of agentic products.

What You’ll Do

• Unify authentication: API keys, management keys, browser sessions, OAuth and OIDC tokens and MCP logins all resolve to a single principal with one authorization model.
• Build delegated access for apps and agents: Sign in with OpenRouter, OAuth for MCP clients with dynamic client registration, and consent grants that can be revoked without touching the underlying key.
• Go secretless with workload identity: CI pipelines and cloud workloads exchange their own identity provider tokens for short-lived OpenRouter credentials under org-defined federation policies.
• Build composable authorization: A single permission model where every route asks "can this caller do this, here?"
• Make enterprise provisioning just work: SCIM user and group provisioning, group-to-role mapping, domain verification and self-serve SSO.
• Define the core identity model: Users, organizations, workspaces, memberships, apps and guardrails, and how they compose.
• Protect users and their data: Identity fraud detection, KYC and verification flows, step-up checks on sensitive actions, account-takeover defenses and abuse signals.
• Treat auditability and correctness as features: The system ensures every credential has a provenance, every access decision is explainable and every privileged change lands in an audit log.
• Work cross-functionally: Partner closely with the Trust & Safety team on fraud and abuse, with the Money team on payment-linked verification and risk.

What We’re Looking For

• 5+ years building production identity, authentication or authorization systems at a SaaS, developer-platform or security company.
• Deep fluency in identity standards: OAuth 2.x (PKCE, token exchange, dynamic client registration), OIDC, SAML, SCIM and JWTs.
• Experience designing authorization models (RBAC, ABAC or ReBAC) for multi-tenant B2B products.
• Hands-on experience integrating enterprise identity providers (Okta, Entra ID, Google Workspace) and an auth platform (Clerk, Auth0, WorkOS or similar).
• Strong TypeScript and SQL.
• A security mindset.
• You work well across teams.
• High agency and AI-forward.

Nice to Haves

• You've shipped enterprise SSO and SCIM that passed real customer security reviews.
• You've built workload identity federation or secretless auth for CI and cloud workloads.
• You've built OAuth, consent and delegation for AI agents or MCP clients acting on behalf of users.
• Experience with identity verification, KYC or fraud and risk systems.
• Experience with policy engines or fine-grained authorization.