← Coupang Interview Insights

Coupang·Software Engineer·Onsite - System Design / Architecture·Senior

SeniorPrefer not to say
Apr 2026

Summary

Coupang system design round focused entirely on IAM, which sounds scoped until you realize how much surface area it actually covers. Walked out feeling like I'd covered maybe 60% of what they wanted.

Questions Asked (1)

Q1

Design a full Identity and Access Management system covering authentication, authorization, multi-tenancy, token lifecycle, audit logging, scalability, and high availability.

System DesignTechnical Trade-offsAPI & Integrations
Author's notes

This question is basically five questions duct-taped together.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements and scale (e.g., number of users, tenants, QPS, latency SLOs) before diving into components. Then present a high-level architecture covering authentication, authorization, token management, multi-tenancy, audit logging, and HA/scalability, and finally discuss trade-offs and failure modes.

Pro tip: Emphasize how you would evolve the system from MVP to production scale, showing awareness of operational concerns like key rotation, token revocation, and tenant isolation. Mention concrete technologies (e.g., OAuth 2.0, OIDC, JWT, RBAC/ABAC, Kafka for audit) but focus on principles over product names.

1. Clarify Requirements and Constraints

Ask about scale (users, tenants, QPS), latency SLOs, compliance needs (e.g., GDPR, PCI), and existing infrastructure. This shows you prioritize understanding before designing.

2. High-Level Architecture

Outline core components: authentication service (OIDC/OAuth), authorization service (policy engine), token service (issuance/validation), tenant management, audit logging pipeline, and data stores. Explain how they interact.

3. Deep Dive into Key Areas

Detail authentication flows (e.g., password, MFA, SSO), authorization models (RBAC/ABAC), multi-tenancy isolation (data and policy), token lifecycle (issuance, refresh, revocation), and audit logging (what, where, retention).

4. Scalability and High Availability

Discuss horizontal scaling of stateless services, caching strategies (e.g., for token validation), database sharding/partitioning by tenant, and HA via replication, multi-AZ deployment, and graceful degradation.

5. Trade-offs and Failure Modes

Highlight trade-offs (e.g., centralized vs. decentralized authorization, token revocation vs. statelessness) and failure scenarios (e.g., token service outage, audit log backpressure) with mitigations.

Key Points to Mention

  • Use of OAuth 2.0/OpenID Connect for authentication and JWT for tokens, with short-lived access tokens and refresh tokens.
  • Authorization via RBAC or ABAC with a policy decision point (PDP) and policy enforcement point (PEP), possibly using OPA or similar.
  • Multi-tenancy: tenant isolation at data, policy, and token levels; consider silo, pool, or bridge models.
  • Token lifecycle: secure issuance, validation (signature, expiry), revocation (blacklist or short TTL), and rotation of signing keys.
  • Audit logging: immutable, tamper-evident logs with async pipeline (e.g., Kafka) and retention policies; include who, what, when, where.
  • Scalability & HA: stateless services, caching, database partitioning, multi-region deployment, and circuit breakers.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.