SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
OpenRouter is the leading AI routing and infrastructure layer that enterprises use to access, manage, and optimize large language models across providers without lock-in or unnecessary cost. You will be the first Software Engineer on the Identity Platform team, owning identity and access control across OpenRouter's inference gateway, marketplace, and agentic products.
In this role, you'll design and build the trust layer that enables millions of developers, thousands of organizations, and autonomous agents to authenticate securely and access resources appropriately. Your responsibilities include:
- Unifying authentication across multiple credential formats (API keys, browser sessions, OAuth, OIDC, MCP logins) into a single authorization model, including sign-in, MFA, passkeys, and enterprise SSO (SAML/OIDC).
- Building delegated access for apps and agents, enabling them to act on users' behalf without handling secrets, with revocable consent grants.
- Implementing workload identity federation for CI pipelines and cloud workloads to exchange identity provider tokens for short-lived credentials without static secrets.
- Designing a composable authorization model where every request is evaluated against permissions, supporting org/workspace roles, read-only keys, and future custom roles.
- Enabling enterprise provisioning at scale: SCIM user/group provisioning, group-to-role mapping, domain verification, and self-serve SSO with Okta, Entra ID, Google Workspace, and other providers.
- Defining the core identity data model (users, organizations, workspaces, memberships, apps) to support five years of enterprise growth.
- Protecting users through fraud detection, KYC flows, step-up checks, account-takeover defenses, and least-privilege access controls.
- Ensuring auditability and correctness: every credential has provenance, every access decision is explainable, and privileged changes are logged.
- Working cross-functionally with Trust & Safety, Money, Product, Sales, and Customer Success teams on enterprise security reviews and rollouts.
REQUIREMENTS:
- 5+ years building production identity, authentication, or authorization systems at a SaaS, developer-platform, or security company.
- Deep fluency in identity standards: OAuth 2.x (PKCE, token exchange, dynamic client registration), OIDC, SAML, SCIM, and JWTs, including practical knowledge of failure modes.
- Experience designing authorization models (RBAC, ABAC, or ReBAC) for multi-tenant B2B products, including live system migrations from ad-hoc checks to unified models.
- Hands-on experience integrating enterprise identity providers (Okta, Entra ID, Google Workspace) and auth platforms (Clerk, Auth0, WorkOS, or similar).
- Strong TypeScript and SQL; comfortable with Postgres and building low-latency, cache-heavy services on critical request paths.
- Security mindset: think in threat models, design for least privilege, and communicate decisions to enterprise security reviewers.
- Cross-functional collaboration skills; ability to translate messy enterprise requirements into clean systems.
- High agency and AI-forward approach; daily use of coding agents and interest in automating security and onboarding workflows.
NICE TO HAVES:
- Shipped enterprise SSO and SCIM through real customer security reviews.
- Built workload identity federation or secretless auth for CI/cloud workloads.
- Built OAuth, consent, and delegation for AI agents or MCP clients.
- Experience with identity verification, KYC, or fraud/risk systems (Stripe Identity, Persona, Sift).
- Experience with policy engines or fine-grained authorization (OpenFGA, Cedar, OPA, Zanzibar-style systems).
- Helped achieve SOC 2, ISO 27001, or similar compliance.
- Existing OpenRouter user or AI tooling project experience.
