From API Keys to Open Platform

Context

Affinity is a CRM for venture capital and private equity firms. Until 2025, programmatic access was limited to a single per-user API key, with no admin visibility and no path to support OAuth, AI agents, or third-party apps.

I'm design lead for Open Platform, the team that owns Affinity's developer ecosystem. I started the vision work in summer 2025. The brief was narrow: build admin tooling for API keys. The opportunity was broader. The choices we made on the first surface would constrain every surface after it.

The Work

I designed for what I knew the team would build, API Keys, OAuth, and a future marketplace, and made a deliberate bet on extensibility for what I didn't know yet.

The most consequential decisions happened upstream of the UI: how we defined “an app,” how the Create App flow could absorb new credential types over time, where the line sits between managing a credential and managing an application.

That extensibility paid off. When MCP became a priority in 2026, the Create App pattern absorbed CIMD as a third credential type without a redesign. I didn't know MCP was coming when I designed the flow. I knew something was, and the cost of designing for that was low.

This is the pattern I try to apply across platform work: cheap bets on extensibility where the cost is low.

Impact

• App creates grew from 48 in November 2025 to over 1,200 per month by spring 2026
• API Keys, OAuth, and MCP share the same surface and mental model, with no redesigns as each was added
• The platform arc is the foundation for Affinity's AI agent strategy
• Marketplace vision informing 2026 platform planning