Software Engineer, Identity Platform

About the role

ABOUT OPENROUTER

OpenRouter is the leading AI routing and infrastructure layer that enterprises use to access, manage, and optimize the best large language models across providers—without lock-in, capacity constraints, or unnecessary cost. We power the most advanced AI teams in the world by giving them the flexibility to move fast, scale confidently, and stay future-proof as models evolve.

As enterprise adoption of AI accelerates, OpenRouter sits at the center of how organizations operationalize LLMs across research, product, and production workloads.

ABOUT THE ROLE

Every request that flows through OpenRouter starts with a question: who is this, and what are they allowed to do? Millions of developers, thousands of organizations and a growing fleet of autonomous agents reach us through API keys, browser sessions, OAuth apps, MCP clients and federated cloud workloads. The credential formats differ, but every one of them has to resolve to the same trustworthy answer.

We're hiring our first Software Engineer, Identity Platform to envision, build and own identity across OpenRouter's inference gateway, marketplace and rapidly growing suite of agentic products. You will define how people, organizations, workspaces, apps and agents authenticate, what they can access, and how that access is delegated, governed and revoked, from a solo developer's first sign-in to a Fortune 500 rollout provisioned straight from their identity provider. If you love the intersection of security, systems design and product, this is your chance to build the trust layer that takes OpenRouter into the enterprise.

WHAT YOU’LL DO

- Unify authentication. API keys, management keys, browser sessions, OAuth and OIDC tokens and MCP logins all resolve to a single principal with one authorization model. Own sign-in, MFA, passkeys and enterprise SSO (SAML and OIDC) on top of it, plus the full lifecycle of every credential we issue: scoped, expiring, rotatable and revocable.

- Build delegated access for apps and agents. Sign in with OpenRouter, OAuth for MCP clients with dynamic client registration, and consent grants that can be revoked without touching the underlying key. Apps and agents act on a user's behalf without ever handling a secret, and admins can pin that consent to an org or workspace across a managed fleet.

- Go secretless with workload identity. CI pipelines and cloud workloads exchange their own identity provider tokens for short-lived OpenRouter credentials under org-defined federation policies, and internal services authenticate to each other the same way. No static secrets to leak or rotate.

- Build composable authorization. A single permission model where every route asks "can this caller do this, here?" instead of checking role names. Org and workspace roles, viewer and restricted roles, read-only automation keys and, over time, custom roles. Deny by default, enforced on the server and reflected cleanly in the UI.

- Make enterprise provisioning just work. SCIM user and group provisioning, group-to-role mapping, domain verification and self-serve SSO that works first try with Okta, Entra ID, Google Workspace and the long tail of identity providers. Partner platforms can provision accounts and keys for their own customers programmatically. An IT admin should be able to onboard thousands of seats without filing a ticket.