Software Engineer, Identity Platform

OpenRouter · Remote, United States

About OpenRouter

OpenRouter is the leading AI routing and infrastructure layer that enterprises use to access, manage, and optimize the best large language models across providers—without lock-in, capacity constraints, or unnecessary cost. We power the most advanced AI teams in the world by giving them the flexibility to move fast, scale confidently, and stay future-proof as models evolve.
As enterprise adoption of AI accelerates, OpenRouter sits at the center of how organizations operationalize LLMs across research, product, and production workloads.
Millions of developers, thousands of organizations and a growing fleet of autonomous agents reach us through API keys, browser sessions, OAuth apps, MCP clients and federated cloud workloads. Were hiring our first Software Engineer, Identity Platform to envision, build and own identity across OpenRouters inference gateway, marketplace and rapidly growing suite of agentic products. You will define how people, organizations, workspaces, apps and agents authenticate, what they can access, and how that access is delegated, governed and revoked, from a solo developers first sign-in to a Fortune 500 rollout provisioned straight from their identity provider. Build delegated access for apps and agents.

Sign in with OpenRouter, OAuth for MCP clients with dynamic client registration, and consent grants that can be revoked without touching the underlying key. Apps and agents act on a users behalf without ever handling a secret, and admins can pin that consent to an org or workspace across a managed fleet.
CI pipelines and cloud workloads exchange their own identity provider tokens for short-lived OpenRouter credentials under org-defined federation policies, and internal services authenticate to each other the same way. SCIM user and group provisioning, group-to-role mapping, domain verification and self-serve SSO that works first try with Okta, Entra ID, Google Workspace and the long tail of identity providers. Partner platforms can provision accounts and keys for their own customers programmatically. An IT admin should be able to onboard thousands of seats without filing a ticket.
Users, organizations, workspaces, memberships, apps and guardrails, and how they compose. Clean boundaries, clear ownership semantics and a data model that supports the next five years of enterprise features without a rewrite.
Protect users and their data.

Identity fraud detection, KYC and verification flows, step-up checks on sensitive actions, account-takeover defenses and abuse signals that stop bad actors without adding friction for good ones. Least-privilege access to customer data across every OpenRouter surface.
An access grant nobody can explain is a bug.
Partner closely with the Trust & Safety team on fraud and abuse, with the Money team on payment-linked verification and risk, with Product on dashboard and onboarding experiences, and with Sales and CS on enterprise security reviews and SSO rollouts.
5+ years building production identity, authentication or authorization systems at a SaaS, developer-platform or security company.
~ x (PKCE, token exchange, dynamic client registration), OIDC, SAML, SCIM and JWTs, and the ways they break in practice.
~ Hands-on experience integrating enterprise identity providers (Okta, Entra ID, Google Workspace) and an auth platform (Clerk, Auth0, WorkOS or similar).
~ Strong TypeScript and SQL. Comfortable with Postgres and building low-latency, cache-heavy services on a critical request path.
~ High agency and AI-forward. Youve shipped enterprise SSO and SCIM that passed real customer security reviews.
Youve built workload identity federation or secretless auth for CI and cloud workloads.
Youve built OAuth, consent and delegation for AI agents or MCP clients acting on behalf of users.
Experience with identity verification, KYC or fraud and risk systems (e.g. Experience with policy engines or fine-grained authorization (e.g. Youve helped a company achieve SOC 2, ISO 27001 or similar compliance.
Youre an existing OpenRouter user, or have built projects in AI tooling.