Software Engineer, Identity Platform

Software Engineer, Identity Platform

OpenRouter operates as the central routing and infrastructure layer for enterprise artificial intelligence, allowing organizations to access and manage large language models across multiple providers without vendor lock-in or unnecessary cost. The company enables advanced AI teams to scale confidently while staying adaptable as models evolve, positioning itself at the core of how enterprises operationalize language models across research, product and production environments.

This role represents OpenRouter's first dedicated Software Engineer focused on the identity platform. You will architect and own the authentication and authorization systems that serve millions of developers, thousands of organizations and a growing network of autonomous agents accessing the platform through API keys, browser sessions, OAuth applications, MCP clients and federated cloud workloads. This is an opportunity to build the trust infrastructure that enables OpenRouter to scale from individual developers to Fortune 500 enterprise deployments.

What you'll do

• Unify authentication across all credential types, including API keys, browser sessions, OAuth and OIDC tokens and MCP logins, while owning the complete lifecycle of sign-in, multi-factor authentication, passkeys and enterprise SSO using SAML and OIDC standards.

• Build delegated access for applications and autonomous agents, enabling them to act on behalf of users without handling secrets while giving administrators visibility and control over consent grants and organizational scoping.

• Implement secretless workload identity, allowing CI pipelines and cloud workloads to exchange identity provider tokens for short-lived credentials under federation policies rather than managing static secrets.

• Design a composable authorization model where every access decision evaluates specific capabilities in specific contexts rather than relying on role names, with support for organizational roles, workspace restrictions and evolving custom permissions.

• Enable enterprise provisioning at scale, including SCIM user and group provisioning, group-to-role mapping, domain verification and self-serve SSO that works seamlessly with Okta, Entra ID and Google Workspace on first attempt.

• Define the core identity data model supporting users, organizations, workspaces, memberships and applications with clean ownership semantics that will scale through the next several years of enterprise features.

• Implement fraud detection, account-takeover defenses and abuse prevention while maintaining least-privilege access to customer data across all OpenRouter services.

• Build auditability and correctness into the system so every credential has documented provenance, every access decision is explainable and every privileged change appears in audit logs.

What you'll bring

• Five or more years of hands-on experience building production identity, authentication or authorization systems at a SaaS company, developer platform or security organization.

• Deep knowledge of OAuth 2.x including PKCE and token exchange, OIDC, SAML, SCIM, JWT standards and practical experience with their limitations and failure modes.

• Experience designing authorization models like RBAC or ABAC for multi-tenant B2B products, ideally including migrating existing systems from ad-hoc permission checks to unified models.

• Demonstrated experience integrating enterprise identity providers such as Okta and Entra ID with authentication platforms like Clerk, Auth0 or WorkOS.

• Strong proficiency in TypeScript and SQL with comfort building low-latency, cache-heavy services in Postgres that run on critical request paths.

• Security-first thinking, including threat modeling, least-privilege design principles and the ability to explain architectural decisions to enterprise security teams.

• Cross-functional collaboration skills, with experience partnering with teams across trust and safety, product, sales and customer success to translate complex requirements into scalable systems.

• High agency and comfort using AI coding tools daily to automate manual work and improve security and onboarding processes.

Nice to have

• Shipped enterprise SSO and SCIM implementations that passed customer security reviews.

• Built workload identity federation or secretless authentication systems for CI pipelines and cloud environments.

What they offer

• Full-time remote position based in the United States.