Seiko Epson Adopts Authlete for Epson Connect API’s Authentication and Authorization Infrastructure

We’re pleased to announce that Seiko Epson Corporation (Seiko Epson) has adopted our OAuth and OpenID Connect (OIDC) backend service for the authentication and authorization infrastructure of the Epson Connect API.

Seiko Epson offers Epson Connect, a cloud service that connects smart devices and PCs with Epson printers and multifunction printers via the internet, enabling remote printing and the upload of scanned data to cloud storage. The company also provides the Epson Connect API, a free web API that enables registered developer partners to embed scanning and printing functionality into their own applications.

For Epson Connect API Ver. 2.0, the latest version of the API, Seiko Epson adopted Authlete to implement OAuth for its authentication and authorization infrastructure.

Background

Since its launch in 2011, Epson Connect has continuously added new features, and its usage has grown to approach initial projections. Consequently, from 2024 to 2025, Seiko Epson undertook a fundamental upgrade to an architecture capable of handling high-volume printing. Along with this architectural overhaul, the company decided to release the new Epson Connect API Ver. 2.0 (API v2) with enhanced security, and to redesign the authentication and authorization capabilities for API v2.

Requirements and Challenges  

The requirements for the authentication and authorization of the new API v2 infrastructure were as follows:

• ‍Utilization of the existing user authentication infrastructure: User authentication must use the existing infrastructure of Epson Global ID, a shared account system for multiple web services provided by the Seiko Epson Group.‍
• Strict device-level access control: Access tokens that allow operations only on user-authorized devices, such as printers, must be issued.

Initially, Seiko Epson considered building an OAuth authorization server from scratch in-house to meet these requirements. However, the company determined that it would require substantial development time. It also concluded that handling ongoing security updates and responding swiftly to new vulnerabilities solely with internal resources would be unrealistic.

As an alternative, they considered adopting a managed Identity as a Service (IDaaS) solution such as Auth0. Although IDaaS would solve the challenges associated with in-house development and operations, the company had concerns about whether it could support the service-specific requirement of issuing access tokens for device-level control.

Why Authlete for the New Authentication/Authorization Infrastructure 

Ultimately, Seiko Epson chose to build its OAuth authorization server in-house using Authlete. Within the new authorization server’s functionality, the company externalized user authentication to Epson Global ID and implemented new authorization logic for issuing access tokens based on a device information database. Meanwhile, OAuth protocol processing and token lifecycle management were delegated to Authlete via its APIs.

This enabled the required authorization flow: when a user logs in via Epson Global ID and selects a device on the printer/scanner selection screen, the partner application is granted permission only for operations related to that specific device.

Benefits of Adopting Authlete

By adopting Authlete, Seiko Epson achieved the following results:‍

• ‍Utilization of the existing user authentication infrastructure: Authlete is a headless API specializing in OAuth/OIDC implementation and does not retain user information. This allowed Seiko Epson to integrate Authlete smoothly into its user authentication infrastructure. As a result, the company completed the development of the authorization server within the project timeline.‍
• Implementation of business-specific authorization logic: Seiko Epson needed to incorporate service-specific authorization logic that issues tokens linked to specific devices. Since Authlete is not a full authorization server itself but rather an API specialized in protocol processing and token management, Seiko Epson was able to implement authorization logic that fully met this business requirement.‍
• Minimizing the burden of keeping up with the latest specifications: Authlete continuously supports security updates and the latest OAuth/OIDC specifications. By adopting Authlete, Seiko Epson stays compliant with these updates without requiring in-house OAuth experts, allowing them to focus on implementing business logic.‍
• Smooth migration from the existing authorization server: Even after the release of API v2, Seiko Epson needed to continue providing the old infrastructure (API v1) in parallel for a certain period. At the same time, the token management mechanism of the API v1 infrastructure had to be updated. For this migration, by leveraging Authlete's unique features, such as Client ID Alias and fine-grained refresh token policies, user and client information from the old infrastructure was smoothly migrated to the new Authlete-powered infrastructure.

Comment from Takumi Yoshida, P Office & Home Solutions Operations Division, P Office & Home Planning & Design Department, Seiko Epson Corporation

"Authlete's service was an ideal fit for building an authorization server in combination with our user authentication infrastructure. Developing it from scratch was unrealistic, and it would have been extremely difficult to upgrade our authentication and authorization infrastructure on schedule without introducing Authlete. Since Authlete keeps up with standard security updates and the latest specifications, it is a huge help to be able to focus on developing business logic while maintaining security."

‍

Read more customer success stories here.

‍