· ai-devtools
OpenAI's 1.2 billion WAUs necessitate Ory's decoupled IAM for extreme scale
When OpenAI revealed that ChatGPT had surpassed 1.2 billion weekly active users (WAUs) at DevDay, the focus naturally drifted toward model context windows and compute clusters.
However, beneath every API call and chat session lies a massive infrastructure hurdle: Identity and Access Management (IAM) at extreme web scale. As one source noted, “Behind every chat session, API call, and model invocation sits an equally monumental infrastructure challenge: Identity and Access Management (IAM) at extreme web scale.”
To handle the sheer volume of transactions without introducing latency issues, OpenAI adopted Ory, leveraging its lightweight, decoupled authentication engine and OAuth2/OIDC infrastructure.
The shift from human traffic to agent workloads changes authentication patterns dramatically. “When an enterprise moves from human-initiated UI clicks to autonomous AI agents… the ratio of token validations to human interactions scales non-linearly.”
This non-linear scaling is driven by transaction velocity, where one agent request can trigger many downstream tasks, and token introspection overhead, as centralized providers struggle with billions of requests per minute.
To avoid authorization becoming the request path bottleneck, validation must occur synchronously at the edge using lightweight cryptographic checks, such as JSON Web Key Sets / JWKS caching, instead of relying on stateful network calls.
Evaluating identity platforms shows traditional multi-tenant SaaS products often hit performance walls. In contrast, self-hosted composable IAM, like Ory, provides edge-native stateless JWT validation and complete data sovereignty.
Benjamin Billings, Engineering Manager at OpenAI, stated, “OpenAI wanted a partner that could help enable our vision for owning our identity processes, data, and success. We have a lot of partners, and Ory is one of our best.”
Modern, high-throughput identity systems demand four core principles: separating identity state from business logic, distributing persistence across cloud regions, implementing agent security via "observe mode," and ensuring fine-grained access control.
Ultimately, “Scaling authentication to 1.2 billion weekly active users proves that identity is no longer just a security checkbox; it is a core distributed systems challenge.”
