← All roles

Software Engineer, Identity Platform

OpenRouter· Engineering
Apply on company site
Remote$215k - $285kFull-timePosted 4d ago

About the role

OpenRouter is hiring its first Software Engineer, Identity Platform to envision, build and own identity across OpenRouter's inference gateway, marketplace and agentic products. You will define how people, organizations, workspaces, apps and agents authenticate, access, and how that access is delegated, governed and revoked, from solo developers to Fortune 500 deployments.

Responsibilities

  • Unify authentication. API keys, management keys, browser sessions, OAuth and OIDC tokens and MCP logins all resolve to a single principal with one authorization model. Own sign-in, MFA, passkeys and enterprise SSO (SAML and OIDC) on top of it, plus the full lifecycle of every credential we issue: scoped, expiring, rotatable and revocable.
  • Build delegated access for apps and agents. Sign in with OpenRouter, OAuth for MCP clients with dynamic client registration, and consent grants that can be revoked without touching the underlying key. Apps and agents act on a user\'s behalf without ever handling a secret, and admins can pin that consent to an org or workspace across a managed fleet.
  • Go secretless with workload identity. CI pipelines and cloud workloads exchange their own identity provider tokens for short-lived OpenRouter credentials under org-defined federation policies, and internal services authenticate to each other the same way. No static secrets to leak or rotate.
  • Build composable authorization. A single permission model where every route asks "can this caller do this, here?" instead of checking role names. Org and workspace roles, viewer and restricted roles, read-only automation keys and, over time, custom roles. Deny by default, enforced on the server and reflected cleanly in the UI.
  • Make enterprise provisioning just work. SCIM user and group provisioning, group-to-role mapping, domain verification and self-serve SSO that works first try with Okta, Entra ID, Google Workspace and the long tail of identity providers. Partner platforms can provision accounts and keys for their own customers programmatically. An IT admin should be able to onboard thousands of seats without filing a ticket.
  • Define the core identity model. Users, organizations, workspaces, memberships, apps and guardrails, and how they compose. Clean boundaries, clear ownership semantics and a data model that supports the next five years of enterprise features without a rewrite.
  • Protect users and their data. Identity fraud detection, KYC and verification flows, step-up checks on sensitive actions, account-takeover defenses and abuse signals that stop bad actors without adding friction for good ones. Least-privilege access to customer data across every OpenRouter surface.
  • Treat auditability and correctness as features. The system ensures every credential has a provenance, every access decision is explainable and every privileged change lands in an audit log. Auth stays fast and highly available on the hot path of every inference request, with clear, standards-based failure modes developers can debug on their own. An access grant nobody can explain is a bug.
  • Work cross-functionally. Partner closely with the Trust & Safety team on fraud and abuse, with the Money team on payment-linked verification and risk, with Product on dashboard and onboarding experiences, and with Sales and CS on enterprise security reviews and SSO rollouts.

Qualifications

  • 5+ years building production identity, authentication or authorization systems at a SaaS, developer-platform or security company.
  • Deep fluency in identity standards: OAuth 2.x (PKCE, token exchange, dynamic client registration), OIDC, SAML, SCIM and JWTs, and the ways they break in practice.
  • Experience designing authorization models (RBAC, ABAC or ReBAC) for multi-tenant B2B products, including migrating a live system from ad-hoc checks to a unified model.
  • Hands-on experience integrating enterprise identity providers (Okta, Entra ID, Google Workspace) and an auth platform (Clerk, Auth0, WorkOS or similar).
  • Strong TypeScript and SQL. Comfortable with Postgres and building low-latency, cache-heavy services on a critical request path.
  • A security mindset. You think in threat models, design for least privilege and can explain your decisions to an enterprise security reviewer.
  • You work well across teams. You'll partner daily with Trust & Safety, Money, Product, Sales and CS, and turn messy enterprise asks into clean systems.
  • High agency and AI-forward. You use coding agents daily and like automating away manual security and onboarding work.

Skills

Required:OAuth 2.xOIDCSAMLSCIMSQLTypeScript

Benefits

  • Offers Equity
  • Remote (US)
Last updated Oct 22, 2026. Interested? Apply on the company site.
OpenRouter logo

About OpenRouter

The Unified Interface For LLMs

A router for LLMs and other AI models

ai-infrastructure-and-developmentbrex-fastest-growing-2025wing-list-2026wing-list-2026-mid-stage
Company profileWebsite

More open roles at OpenRouter