Software Engineer, SDK

About the role

ABOUT KEYCARD

At Keycard, we're building identity and access infrastructure for the agent-native era, where software isn't static but a dynamic, constantly changing system of AI agents working on behalf of people and businesses. Keycard gives every agent a verified identity and issues short-lived, task-scoped credentials at runtime, so agents can only do what they were asked to do, and every action is fully auditable. We're backed by a16z, Boldstart, and Acrew, and our founding team built and scaled Snyk, Auth0, HashiCorp, and Heroku.

THE ROLE

We're hiring a staff-level Software Engineer, SDK to own the libraries developers use to put Keycard in front of their agents and MCP servers. For most teams, the SDK is the first Keycard code they touch: a few lines that add OAuth to an MCP server, then token exchange so a tool can call GitHub or Google as the user.

Keycard is a control plane for agents: identity, credential exchange, delegation, policy, and audit. Our SDKs come in two kinds. The REST API clients for Python, TypeScript, and Go are generated from our OpenAPI spec. The agent SDKs are handwritten: OAuth primitives, MCP server and client auth, agent-to-agent (A2A) delegation (in preview), and integrations for frameworks like FastMCP, LangChain, Temporal, and Cloudflare Workers. The hard design work is on the handwritten side.

Python is the most complete today. TypeScript is in preview and working toward parity, and Go and Ruby are earlier. Keeping behavior consistent across four languages, while priorities differ and TypeScript comes next, is the core of the job. You'll work with founders, product, and the engineers building the services underneath.

WHAT YOU'LL DO

- API design. Keep authorization concepts and behavior consistent across languages while making each API idiomatic. Map credential types and error semantics across Python, TypeScript, Go, and Ruby.

- Safe defaults. Require the expected issuer and audience for token validation, and handle signing-key outages without accepting unverified tokens. Refresh client-held access tokens when the grant permits it, and return clear errors when fresh authorization is needed.

- Track upstream. Our MCP package follows the upstream MCP SDK's major versions, and framework integrations are tested nightly against each upstream's latest release. Ship support for new versions quickly, and decide when an old line moves to security fixes only.

- Releases. Each package versions and publishes on its own, to PyPI, npm, and RubyGems, with Go modules released as versioned tags in their repos. Own semver, changelogs, deprecations, and the CI that bumps and publishes on merge.

- Generated clients. Own the path from our OpenAPI spec to the generated clients. Fix problems in the spec, not in generated code.

- Developer experience. Quick starts, examples, and docs that take someone from install to a protected MCP server, and a loop that turns developer feedback into API changes.