# Effortless enterprise authentication at Grab: Dex in action

[Grab](https://yomu.fyi/company/grab) · Kah Wei Lee · May 23, 2025

## Summary

Grab needed a centralised system to simplify identity management, satisfy audit requirements, and standardise authentication across internal and external tools like Databricks and Datadog. The engineering team selected OpenID Connect as their standard protocol and adopted Dex, an open-source CNCF identity aggregator. Dex acts as an intermediary between applications and multiple identity providers to issue standardised OIDC tokens. To secure service-to-service communication, Grab implemented token exchange with trusted peer relationships rather than relying on privileged service accounts. Dex also provides a kill-switch mechanism that can route authentication traffic to an alternate provider during identity provider outages.

## Takeaways

- Dex serves as a federated OpenID Connect aggregator, standardising authentication tokens across multiple internal apps and external platforms.
- Token exchange between trusted peer services mints scoped tokens that include multiple audiences, avoiding the security risks and broad permissions of shared service accounts.
- Supporting multiple identity providers within Dex enables a kill switch that redirects authentication traffic during third-party provider outages without modifying integrated applications.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Authentication](https://yomu.fyi/topic/authentication), [Open Source](https://yomu.fyi/topic/open-source), [Reliability](https://yomu.fyi/topic/reliability)

[Read original post](https://engineering.grab.com/dex-in-action)