Software Engineer at Keycard Labs

Job description

ABOUT KEYCARD At Keycard, we're building identity and access infrastructure for the agent-native era, where software isn't static but a dynamic, constantly changing system of AI agents working on behalf of people and businesses. Keycard gives every agent a verified identity and issues short-lived, task-scoped credentials at runtime, so agents can only do what they were asked to do, and every action is fully auditable. We're backed by a16z, Boldstart, and Acrew, and our founding team built and scaled Snyk, Auth0, HashiCorp, and Heroku. THE ROLE We're hiring a staff-level Software Engineer, SDK to own the libraries developers use to put Keycard in front of their agents and MCP servers. For most teams, the SDK is the first Keycard code they touch: a few lines that add OAuth to an MCP server, then token exchange so a tool can call GitHub or Google as the user. Keycard is a control plane for agents: identity, credential exchange, delegation, policy, and audit. Our SDKs come in two kinds. The REST API clients for Python, TypeScript, and Go are generated with Stainless from our OpenAPI spec. The agent SDKs are handwritten: OAuth primitives, MCP server and client auth, agent-to-agent (A2A) delegation (in preview), and integrations for frameworks like FastMCP, LangChain, Temporal, and Cloudflare Workers. The hard design work is on the handwritten side. Python is the most complete today. TypeScript is in preview and working toward parity, and Go and Ruby are earlier. Keeping four languages consistent, without treating any of them as second-class, is the core of the job. You'll work with founders, product, and the engineers building the services underneath. WHAT YOU'LL DO - API design. Decide what each package exposes and keep it consistent across languages. An AuthProvider in Python should feel like the one in TypeScript, Go, and Ruby, down to errors and credential types. - Safe defaults. The SDK verifies tokens, refreshes them, and handles signing-key outages, so the safe path has to be the easy one. A verifier built without an audience should warn. An expired token should refresh, not force a new sign-in. - Track upstream. Our MCP package follows the upstream MCP SDK's major versions, and framework integrations are tested nightly against each upstream's latest release. Ship support for new versions quickly, and decide when an old line moves to security fixes only. - Releases. Each package versions and publishes on its own, to PyPI, npm, pkg.go.dev pkg.go.dev, and RubyGems. Own semver, changelogs, deprecations, and the CI that bumps and publishes on merge. - Generated clients. Own the path from our OpenAPI spec to the Stainless-generated clients. Fix problems in the spec, not in generated code. - Developer experience. Quick starts, examples, and docs that take someone from install to a protected MCP server, and a loop that turns developer feedback into API changes. - Agents at work. Coding agents already open a good share of our SDK pull requests. Decide what they're trusted to do, and keep tests and review strong enough to catch what they get wrong. WHAT WE'RE LOOKING FOR - You've shipped libraries or SDKs that other developers depend on, and supported them through breaking changes. - You've kept one API consistent across at least two languages. You write idiomatic Python and TypeScript; Go or Ruby is a plus. - You know OAuth 2.0 and OIDC at the library level: token verification, refresh, PKCE, and token exchange (RFC 8693). - You've managed versioning in the real world: peer dependency ranges, maintenance branches, and deprecations users could plan around. - You build with MCP and agent frameworks, and have opinions about what works and what doesn't. - Agents in your work. You use coding agents daily and know where their output needs a closer look. STRONG CANDIDATES MAY ALSO HAVE - Code generation for multi-language SDKs: Stainless, Speakeasy, Fern, OpenAPI, or protobuf. - Plugin or integration ecosystems, like Terraform providers, framework adapters, or editor extensions. - Contributions to MCP, the A2A protocol (which we support in preview), or open source agent frameworks. - Edge runtimes like Cloudflare Workers, or durable execution like Temporal. YOUR FIRST 90 DAYS - Close the biggest gaps between the TypeScript and Python SDKs, toward dropping TypeScript's preview label. - Publish a cross-language API guide: names, errors, and credential types, mapped across Python, TypeScript, Go, and Ruby. - Take one upstream breaking change, like a new MCP SDK major or framework release, from nightly failure to released support. - Agree an SDK roadmap with product and engineering, including where generated clients end and handwritten SDKs begin. WHO WILL LOVE THIS JOB - You care about the first ten lines a developer writes with your library. - You'd rather design an API once than explain it four different ways. WHAT WE OFFER - Build at the Frontier: Work every day at the frontier of agent-native systems — shipping, inventing, and iterating on technology that hasn’t been built before. You’ll be given huge autonomy, the opportunity to gain mastery, and the chance to work in a team that holds each other accountable to succeed. - Truly Agent-Native Culture: At Keycard, we don’t just enable others to adopt agents — we use them ourselves to build. You’ll help shape an organization that embeds AI into its foundation as an enduring competitive advantage. - Compensation With Upside: Market-competitive salaries and generous equity packages (4-year vest, 1-year cliff) give you the security to focus on building — and the asymmetric upside of ownership in a company chasing a category-defining mission. - Comprehensive Benefits & Recharge: Health, dental, vision, and paramedical coverage for you and your family, plus 4 weeks vacation, 11 statutory holidays, and 1 volunteer day annually. We encourage at least 2 weeks off each year to fully recharge. - Tools That Keep You Ahead: A new MacBook Pro, a $500 stipend for peripherals, and the best AI tools available so you can work at the forefront of agent-native workflows. - Remote-First Flexibility: We are a remote-first team prioritizing asynchronous collaboration, with hiring focused in North and South America. Work where you’re strongest — we just want the best.

Requirements

Must-haves

API design. Decide what each package exposes and keep it consistent across languages. An AuthProvider in Python should feel like the one in TypeScript, Go, and Ruby, down to errors and credential types.
Releases. Each package versions and publishes on its own, to PyPI, npm, pkg.go.dev http://pkg.go.dev, and RubyGems. Own semver, changelogs, deprecations, and the CI that bumps and publishes on merge.
Generated clients. Own the path from our OpenAPI spec to the Stainless-generated clients. Fix problems in the spec, not in generated code.
Developer experience. Quick starts, examples, and docs that take someone from install to a protected MCP server, and a loop that turns developer feedback into API changes.
Agents at work. Coding agents already open a good share of our SDK pull requests. Decide what they're trusted to do, and keep tests and review strong enough to catch what they get wrong.
You've shipped libraries or SDKs that other developers depend on, and supported them through breaking changes.
You know OAuth 2.0 and OIDC at the library level: token verification, refresh, PKCE, and token exchange (RFC 8693).
You've managed versioning in the real world: peer dependency ranges, maintenance branches, and deprecations users could plan around.
You build with MCP and agent frameworks, and have opinions about what works and what doesn't.
Agents in your work. You use coding agents daily and know where their output needs a closer look.
Code generation for multi-language SDKs: Stainless, Speakeasy, Fern, OpenAPI, or protobuf.
Plugin or integration ecosystems, like Terraform providers, framework adapters, or editor extensions.
Contributions to MCP, the A2A protocol (which we support in preview), or open source agent frameworks.
Edge runtimes like Cloudflare Workers, or durable execution like Temporal.
Close the biggest gaps between the TypeScript and Python SDKs, toward dropping TypeScript's preview label.
Publish a cross-language API guide: names, errors, and credential types, mapped across Python, TypeScript, Go, and Ruby.
Take one upstream breaking change, like a new MCP SDK major or framework release, from nightly failure to released support.
Agree an SDK roadmap with product and engineering, including where generated clients end and handwritten SDKs begin.
You care about the first ten lines a developer writes with your library.
You'd rather design an API once than explain it four different ways.

Nice-to-haves

You've kept one API consistent across at least two languages. You write idiomatic Python and TypeScript; Go or Ruby is a plus.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

airestapipythontypescriptgo

Platform: ashby
Effort: quick

Benefits

Benefits detected in the listing.

Dental

Vision