From human clicks to agentic velocity: What OpenAI’s 1.2 billion scale means for your auth

When OpenAI announced at DevDay that ChatGPT had reached 1.2 billion weekly active users (WAUs), about 15% of the world's population, most engineering discussions focused on model context windows, computing clusters, and distributed GPU inference.

However, behind every chat session, API call, and request to an AI model is another huge infrastructure challenge: managing Identity and Access Management (IAM) securely at an enormous scale across the web.

“Behind every chat session, API call, and model invocation sits an equally monumental infrastructure challenge: Identity and Access Management (IAM) at extreme web scale.”

Before OpenAI can send even one token from a large language model (LLM), its backend systems must check who or what is making the request, verify OAuth2 access tokens, check detailed permissions, and keep sessions secure around the world. To handle this huge number of operations without causing delays, OpenAI turned to Ory, using its lightweight authentication engine, which works separately from other systems, and its OAuth2 and OpenID Connect (OIDC) infrastructure.

This article explains how identity systems must change when traffic shifts from people to AI agents, why older IAM platforms struggle with such large numbers of requests, and how separate systems designed to work at the network edge can check permissions quickly while handling very high traffic.

The scale problem: human traffic vs. agentic workloads

To understand why traditional IAM platforms struggle at extreme scale, consider how authentication changes when systems move from ordinary websites to AI platforms that can carry out tasks on their own.

“When an enterprise moves from human-initiated UI clicks to autonomous AI agents… the ratio of token validations to human interactions scales non-linearly.”

When a business moves from people clicking buttons to AI agents that work on their own, such as those in OpenAI’s Work and Codex suites, the number of token checks grows much faster than the number of human interactions:

1. Transaction speed: A single request from a user to an AI agent can start dozens of smaller tasks, database queries, and calls to tools provided by other services. Every step needs a session check and a token check.
2. The cost of checking tokens: Older central identity providers (IdPs) often check access tokens by contacting a central service or looking up information in a database. At billions of requests per minute, these central checks can cause serious delays because requests must travel across networks and database operations compete for access.
3. Checking tokens at the network edge without keeping state: To prevent permission checks from becoming the main cause of delays, systems must check sessions directly at the network edge as part of handling each request. They can use fast cryptographic checks, such as caching JSON Web Key Sets (JWKS), instead of making network calls that depend on information stored and updated on remote servers.

Architectural comparison: modern composable IAM vs. legacy monolithic SaaS

When choosing identity platforms that must handle extremely high traffic, engineering teams often find that traditional identity services shared by many customers, such as Auth0, Okta, and Ping Identity, reach limits in performance and cost.

Architectural dimension	Legacy monolithic identity SaaS	Self-hosted composable IAM (e.g., Ory)
Token validation mechanism	Centralized IdP round-trips or heavy server-side SDKs	Edge-native stateless JWT validation & local session caching
Data residency & ownership	User store hosted in vendor-managed SaaS clouds	Complete data sovereignty (runs directly in your VPC / multi-cloud k8s)
Database persistence strategy	Proprietary SaaS database clusters subject to vendor rate limits	Highly available distributed SQL layers (e.g., CockroachDB, Spanner, Postgres)
Cost scaling model	Per Monthly Active User (MAU) or per-API request execution fees	Infrastructure-based scaling; cost correlates with compute/memory footprint
Customizability & velocity	Restricted to vendor webhooks, rules, or custom code sandboxes	Go-native microservices with clean API boundaries and headless UI integration

“OpenAI wanted a partner that could help enable our vision for owning our identity processes, data, and success. We have a lot of partners, and Ory is one of our best.”

• Benjamin Billings, Engineering Manager, OpenAI (Case study)

Key infrastructure requirements for identity systems serving billions of users

Keeping identity secure at this scale requires each part of the authentication system to have a clear job. Based on high-traffic systems such as OpenAI’s, modern identity architectures rely on four core principles:

1. Keep identity data separate from business logic

Older, all-in-one software often stores user profiles, login information, and business roles together in a single relational database. Systems built to handle very high traffic separate these responsibilities into different small services called microservices:

• Identity storage and authentication engines: Dedicated services manage the identity lifecycle, securely hash passwords and other credentials, and manage sessions. One example is Ory Kratos.
• OAuth2 / OIDC token issuance: High-performance OAuth2 servers issue digitally signed access tokens and manage permission-grant processes with as little delay as possible. One example is Ory Hydra.
• Fine-grained access control (FGAC): These systems control access by checking relationships between users and resources, using models based on Google’s Zanzibar system. One example is Ory Keto. They evaluate relationships represented as ObjectRelationSubject in less than a millisecond.

2. Store data across cloud regions

To support routing requests around the world, the storage system must be able to accept writes in different geographic regions and provide fast reads from nearby locations. Combining a self-hosted identity engine with distributed SQL databases, such as CockroachDB or cloud databases that support multiple regions, allows the information needed to check tokens to be copied around the world. This helps prevent different regions from disagreeing about the data, a problem known as split-brain, and avoids delays caused by sending requests across continents.

3. Secure AI agents: move from strict enforcement to observation mode

As businesses deploy AI agents that carry out actions for users, immediately applying strict identity and access rules can break workflows or cause failures that are difficult to notice. Modern security practices recommend first watching what agents do while they run, before strictly enforcing policies:

• Step 1: Identify each agent: Map every credential used for machine-to-machine (M2M) communication and every agent service account operating across internal networks.
• Step 2: Track what agents do: Review the tools they use, the APIs they call, and the database queries they run while operating on their own.
• Step 3: Control delegated identity: Use scoped OAuth2 Token Exchange (RFC 8693) so agents receive limited permissions tied directly to the human user who authorized them. This helps ensure that agents can only access what they are allowed to use.

For a limited time, you can create a free Ory account and turn on observation mode to learn how to set up enforcement rules.

“Scaling authentication to 1.2 billion weekly active users proves that identity is no longer just a security checkbox; it is a core distributed systems challenge.”

Scaling authentication to 1.2 billion weekly active users proves that identity is no longer just a security checkbox; it is a core distributed systems challenge.

As software shifts from people clicking buttons on screens to AI agents making API calls and carrying out tasks at high speed, engineering teams must check whether their identity systems can handle rapidly growing numbers of requests. Identity systems built from separate components and designed to check requests without relying on central services can provide the low delays, control over data, and predictable performance that modern platforms need as they move into the age of AI agents.