--- title: From human clicks to agentic velocity: What OpenAI’s 1.2... description: OpenAI uses Ory's decoupled authentication engine and OAuth2/OIDC infrastructure to handle identity at the scale of ChatGPT's 1.2 billion weekly active users.... canonical: https://daily.dev/posts/from-human-clicks-to-agentic-velocity-what-openai-s-1-2-billion-scale-means-for-your-auth-zdy9ir16i twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: From human clicks to agentic velocity: What OpenAI’s 1.2 billion scale means for your auth | daily.dev og:description: OpenAI uses Ory's decoupled authentication engine and OAuth2/OIDC infrastructure to handle identity at the scale of ChatGPT's 1.2 billion weekly active users.... og:url: https://daily.dev/posts/from-human-clicks-to-agentic-velocity-what-openai-s-1-2-billion-scale-means-for-your-auth-zdy9ir16i og:image: https://api.daily.dev/og/posts/zDY9ir16I.png og:image:alt: From human clicks to agentic velocity: What OpenAI’s 1.2 billion scale means for your auth og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # From human clicks to agentic velocity: What OpenAI’s 1.2 billion scale means for your auth **[The New Stack](https://daily.dev/sources/newstack)** · 6 min read · 0 upvotes · 0 comments ## Summary OpenAI uses Ory's decoupled authentication engine and OAuth2/OIDC infrastructure to handle identity at the scale of ChatGPT's 1.2 billion weekly active users. As traffic shifts from human clicks to autonomous AI agents, token validation volume scales non-linearly, pushing legacy centralized identity providers past their limits. The fix is stateless, edge-native JWT verification using JWKS caching instead of centralized RPC lookups. Ory's stack separates identity storage (Kratos), OAuth2 token issuance (Hydra), and Zanzibar-style fine-grained access control (Keto), backed by distributed SQL like CockroachDB. For agent security, the piece recommends an 'observe mode' phase using agent fingerprinting, execution tracing and RFC 8693 token exchange before enforcing strict policies. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What identity provider does OpenAI use to handle authentication for ChatGPT at scale? OpenAI uses Ory's decoupled authentication engine and OAuth2/OIDC infrastructure to authenticate requests across its services. This handles identity for ChatGPT, which crossed 1.2 billion weekly active users. Ory's stack separates identity storage (Kratos), OAuth2 token issuance (Hydra), and fine-grained access control modeled on Google's Zanzibar system (Keto). _Teams scaling auth for massive user bases can track identity architecture approaches like this on daily.dev._ ### How should I design OAuth2 token validation to avoid bottlenecks at extremely high request volume? Avoid centralized token introspection, which creates network hops and database lock contention at billions of requests per minute. Instead, use stateless edge verification with lightweight cryptographic checks such as JSON Web Key Sets (JWKS) caching, so session validation happens synchronously at the edge rather than through stateful network calls to a central identity provider. _Developers designing high-throughput auth paths can follow architecture patterns like this on daily.dev._ ### What is the recommended approach for securing AI agents that act on behalf of users with OAuth2 permissions? Use a phased 'observe mode' approach rather than enforcing restrictive policies immediately, since strict rules can silently break agent workflows. First fingerprint every machine-to-machine credential and agent service account, then trace execution of tool and API calls, then implement scoped OAuth2 Token Exchange (RFC 8693) so agents run under permissions downscoped from the delegating human user. _Anyone securing autonomous agent permissions can track emerging practices like this on daily.dev._ ## Similar posts on daily.dev - [AI Agents Authentication: How Autonomous Systems Prove Identity](https://daily.dev/posts/ai-agents-authentication-how-autonomous-systems-prove-identity-ynnf7lwlb) · GitGuardian · 0 upvotes · 0 comments - [JWTs for AI Agents: Authenticating Non-Human Identities](https://daily.dev/posts/jwts-for-ai-agents-authenticating-non-human-identities-63fw1b4g5) · Security Boulevard · 0 upvotes · 0 comments - [AI Agent Identity and Permission Challenges: How Uber and Auth0 Are Rethinking Access Control](https://daily.dev/posts/ai-agent-identity-and-permission-challenges-how-uber-and-auth0-are-rethinking-access-control-fhkr4tfqi) · InfoQ · 0 upvotes · 0 comments - [AI Agents Are Not Users: Building an AI Agent Identity Model](https://daily.dev/posts/ai-agents-are-not-users-building-an-ai-agent-identity-model-0gmsbkuop) · Auth0 · 1 upvotes · 0 comments - [Passing User Identity safely across Agents and Enterprise Systems](https://daily.dev/posts/passing-user-identity-safely-across-agents-and-enterprise-systems-olnhxffga) · Niklas Heidloff · 1 upvotes · 0 comments --- Tags: [#openai](https://daily.dev/tags/openai), [#authentication](https://daily.dev/tags/authentication), [#distributed-systems](https://daily.dev/tags/distributed-systems) [View this post on daily.dev](https://daily.dev/posts/from-human-clicks-to-agentic-velocity-what-openai-s-1-2-billion-scale-means-for-your-auth-zdy9ir16i) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"From human clicks to agentic velocity: What OpenAI’s 1.2 billion scale means for your auth","url":"https://daily.dev/posts/from-human-clicks-to-agentic-velocity-what-openai-s-1-2-billion-scale-means-for-your-auth-zdy9ir16i","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/from-human-clicks-to-agentic-velocity-what-openai-s-1-2-billion-scale-means-for-your-auth-zdy9ir16i"},"datePublished":"2026-10-28T12:02:37.975Z","dateModified":"2026-10-28T15:03:55.853Z","description":"OpenAI uses Ory's decoupled authentication engine and OAuth2/OIDC infrastructure to handle identity at the scale of ChatGPT's 1.2 billion weekly active users....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/34b8335cdd0d2d1506b4bc3c07b96e01?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/34b8335cdd0d2d1506b4bc3c07b96e01?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/from-human-clicks-to-agentic-velocity-what-openai-s-1-2-billion-scale-means-for-your-auth-zdy9ir16i","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"openai,authentication,distributed-systems","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"From human clicks to agentic velocity: What OpenAI’s 1.2 billion scale means for your auth"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/from-human-clicks-to-agentic-velocity-what-openai-s-1-2-billion-scale-means-for-your-auth-zdy9ir16i#faq","mainEntity":[{"@type":"Question","name":"What identity provider does OpenAI use to handle authentication for ChatGPT at scale?","acceptedAnswer":{"@type":"Answer","text":"OpenAI uses Ory's decoupled authentication engine and OAuth2/OIDC infrastructure to authenticate requests across its services. This handles identity for ChatGPT, which crossed 1.2 billion weekly active users. Ory's stack separates identity storage (Kratos), OAuth2 token issuance (Hydra), and fine-grained access control modeled on Google's Zanzibar system (Keto). Teams scaling auth for massive user bases can track identity architecture approaches like this on daily.dev."}},{"@type":"Question","name":"How should I design OAuth2 token validation to avoid bottlenecks at extremely high request volume?","acceptedAnswer":{"@type":"Answer","text":"Avoid centralized token introspection, which creates network hops and database lock contention at billions of requests per minute. Instead, use stateless edge verification with lightweight cryptographic checks such as JSON Web Key Sets (JWKS) caching, so session validation happens synchronously at the edge rather than through stateful network calls to a central identity provider. Developers designing high-throughput auth paths can follow architecture patterns like this on daily.dev."}},{"@type":"Question","name":"What is the recommended approach for securing AI agents that act on behalf of users with OAuth2 permissions?","acceptedAnswer":{"@type":"Answer","text":"Use a phased 'observe mode' approach rather than enforcing restrictive policies immediately, since strict rules can silently break agent workflows. First fingerprint every machine-to-machine credential and agent service account, then trace execution of tool and API calls, then implement scoped OAuth2 Token Exchange (RFC 8693) so agents run under permissions downscoped from the delegating human user. Anyone securing autonomous agent permissions can track emerging practices like this on daily.dev."}}]} ```