The posting
About GoKwik
GoKwik is a growth operating system for D2C and eCommerce brands, enabling checkout optimization, RTO reduction, payments, retention, and post-purchase engagement. Today, GoKwik powers 15,000+ merchants globally, processes ~$2 billion in GMV, and continues to strengthen its AI-powered infrastructure across India, the UK, Europe, and the US.
Why This Role Matters
As an SDE 2 on the App Store & Developer Platform, you will own the system third-party developers build against and merchants install apps from. That covers OAuth and token lifecycle, app registration, scoped permissions, install and uninstall flows, webhook delivery and the public API contract developers depend on. Increasingly, it also means making the platform safe for AI agents and AI-built apps to use.
Our platform is multi-tenant: one system serves many merchants, each with its own catalogue, orders, inventory, pricing and customers, and it handles millions of API calls every week. This is production engineering, not greenfield prototyping. The services you join already carry live traffic, real merchant data and third-party integrations that cannot break.
The defining constraint of this role is that your API is somebody else's production dependency. A breaking change is not a deploy you can roll back quietly; it is an outage in someone else's product. You will own designs for your area, make decisions other engineers build on, run your services in production, and mentor SDE 1 engineers.
What You'll Own
- Design & Delivery - Own the design and delivery of app-store and developer-platform services: write low-level and high-level designs, decide on APIs, data models and failure handling, and document the reasoning.
- OAuth & Token Lifecycle - Own OAuth 2.0 flows end to end: authorisation code with PKCE, refresh and rotation, revocation, scope enforcement and the failure modes of each.
- Public APIs - Build and version public APIs that external developers integrate against, with deprecation paths, contract tests and changelogs that never break live integrations.
- Webhook Delivery at Scale - Design and operate webhooks with HMAC signing, replay protection, retries with backoff, dead-letter handling, ordering guarantees and consumer back-pressure.
- Event-Driven Systems - Design and run Kafka flows: partitioning, ordering, idempotent consumers, retries, dead-letter handling and consumer lag.
- App Lifecycle - Own registration, review, publish, install and uninstall, and the data and permissions each transition must leave behind.
- Multi-Tenant Database Performance - Drive tenant-scoped queries, tenant-leading indexes, partitioning and safe expand-then-contract migrations.
- Caching & Rate Limiting - Use Redis deliberately for caching, distributed locking and per-app / per-merchant rate limiting.
- Production Reliability - Own SLOs and alerts, on-call and incident response, root-cause analysis with observability and APM tooling, and lasting fixes.
- AI-Ready Platform - Design APIs and tool definitions (for example, MCP servers) that LLM agents can use safely, with scoped permissions, rate limits and abuse controls.
- AI Developer Experience - Build LLM-backed features where they help, such as app-review assistance, docs search or integration debugging, with evals and guardrails.
- Reviews & Mentoring - Review critical changes, mentor SDE 1 engineers, and use AI tools across the loop while verifying everything they produce.
Who You Are
- 3+ years of backend engineering with strong Node.js and TypeScript, with hands-on ownership of production services.
- Strong low-level design and working high-level design: you explain constraints, choose an approach and make accountable decisions.
- Multi-tenant data isolation in practice: tenant scoping on every query, cache key, job and webhook, and how to prevent and detect cross-tenant leaks.
- Deep relational database skills (MySQL / PostgreSQL): data modelling, transactions and isolation, indexing, reading query plans and fixing slow queries at scale.
- Designed and shipped APIs consumed by external parties, including versioning, deprecation and backward compatibility.
- Production experience with OAuth 2.0 or similar token-based authorisation, and a security mindset around tokens, scopes and secrets.
- Hands-on Kafka or a similar broker: consumer groups, ordering, at-least-once delivery, idempotency, dead-letter queues and lag monitoring.
- Distributed-systems fundamentals: idempotency, retries and backoff, rate limiting, backpressure and consistency trade-offs.
- Real production ownership: on-call, debugging live incidents, root-cause analysis, and monitoring with logs, metrics and traces.
- Solid understanding of LLM systems: tool/function calling, RAG and vector search, evals, guardrails, prompt injection, and the security implications of letting AI agents call platform APIs.
- Uses AI coding tools daily and productively, with the judgement to verify, test and own generated code.
- Clear design documentation and technical communication, with experience reviewing others' work and mentoring.
- Treats an external contract as a promise and plans its change before it is needed; writes down the failure mode, such as what happens if a process crashes between the API call and the commit.
- Leads with data, acts early without waiting to be asked, and owns outcomes beyond your own tickets.
Why GoKwik
At GoKwik, you work on large-scale commerce infrastructure where correctness under failure, performance at scale, and code the next engineer can change safely all matter. The App Store & Developer Platform is how third-party developers extend GoKwik for merchants, so your work shapes an ecosystem that other products depend on.
You get high ownership of design and production systems, real distributed-systems problems, and the chance to make a platform safe for AI agents and AI-built apps. We use AI across how we build while keeping full responsibility for what ships, in a collaborative, engineering-led environment with strong career growth potential.
