Google Workspace has modernized authentication, but many copiers were designed for a much simpler username-and-password world. Google has steadily moved third-party access away from simple username-and-password sign-in. That is good for account security, but it creates a problem for older copiers.
Why this matters
Confirm whether the copier has native Google OAuth support; many older devices do not.
Use a relay or application that can obtain and refresh OAuth tokens securely on behalf of the connected Gmail or Workspace account.
Keep the copier simple
The copier is usually the hardest component to update and the least pleasant place to troubleshoot identity. Where possible, keep the device-side configuration limited to ordinary SMTP settings and move modern authentication, token refresh, policy, and detailed logging into a service designed to handle them.
Practical points to consider
- Limit the Google permission scope to what the service actually needs for sending.
- Keep refresh tokens encrypted at rest and make reconnecting easy if the user revokes access.
- Test the entire workflow from the physical copier, not only from a browser or API test page.
What a supportable setup looks like
A good Scan-to-Email design should be understandable months after it is installed. IT should know which device is sending, which cloud connection is being used, which destinations are permitted, and where to look when delivery fails.
That usually means using a dedicated or clearly owned sender identity, encrypted credentials or tokens, modern TLS on the cloud side, useful logs, and a documented reconnect process. It also means avoiding broad permissions simply because they are easier to configure.
Where CM Relay fits
CM Relay is designed as the compatibility and policy layer between copiers or other SMTP devices and modern cloud services. The copier can continue using a familiar SMTP workflow while CM Relay handles OAuth-based delivery, connection health, logging, and policy controls such as sender and destination restrictions.
That approach lets an organization modernize the email path without turning a copier replacement project into the only security option.
Further reading
- https://support.google.com/accounts/answer/6010255
- https://developers.google.com/workspace/gmail/imap/xoauth2-protocol
- https://developers.google.com/workspace/gmail/api/auth/web-server
Next step
If your organization is still relying on old SMTP credentials, inconsistent copier settings, or manual workarounds, start by documenting the current Scan-to-Email path. From there, you can decide which parts need to be modernized without disrupting the user experience.
https://cmrelay.com/features/ or https://cmrelay.com/contact/ to discuss your environment.