[Merpay] Emphasizing System Creation That Can Be Scaled Over the Medium-to-Long Term: Merpay’s IDP Team Supporting Product Development for the Entire Group

Mercari: Taking Steps to Become a “Truly Global Tech Company”
In the reuse market, which is valued at over 1 trillion yen, Mercari has continued to make great strides as the industry leader. This year marks the ninth anniversary of the company’s founding and its unwavering mission to “Create value in a global marketplace where anyone can buy & sell.” The next phase they are looking toward is becoming a global tech company second to none in the world. In this special feature, we bring you a glimpse of where Mercari is today and what the future holds for the company as it continues to evolve.

With its sights set on growing into a world-class tech company, Mercari Group is focusing its efforts on the Robust Foundation for Speed (RFS) project to strengthen its tech platform. In this article, we would like to introduce the challenges faced by Merpay as it tackles innovation in the IDP (ID platform) domain involved in authentication and authorization within this RFS initiative.

As part of the Mercari Group company Merpay, the IDP Team has been in charge of authentication and authorization as well as account management for the services and features on the Mercari platform, a marketplace app with over 20 million monthly active users.

Mercari Group is now boldly taking on new services such as the Mercari Shops e-commerce platform newly launched last year, as well as Merwork, which enables users to utilize their idle time to casually help improve Mercari’s services.

Merpay CTO Takashi Nozawa explains, “As new services and new features are being created one after another, the issues of the IDP domain have come into sharp relief.” According to Nozawa, the team has started to work on innovation to solve these issues.

What kind of innovation is Merpay tackling in the IDP domain? We spoke in detail with CTO Nozawa, Engineering Manager Robert Jerovsek, and Tech Lead Tatsuya Karino.

IDP as the core of Mercari Group’s growth

ーTo begin, please tell us about the roles of the IDP Team and its position within Mercari Group.

Karino：The IDP Team is in charge of account management as well as authentication and authorization for the entire Mercari Group and ID-related security associated with those areas.

These areas are involved in almost all services and features on the Mercari platform, so our role is to provide a mechanism that enables each product team to develop services and features without having to worry about the details of how authentication and authorization works for Mercari accounts.

Now, to answer the question as to why the IDP Team belongs to Merpay, the reason is because Merpay was originally launched using microservices, so the issue of how to share user authentication information between microservices was first debated within Merpay rather than Mercari. That team subsequently scaled up and became known as the IDP Team.

Later, the responsibility for managing Mercari accounts was passed to the IDP Team, and the Merpay IDP Team was put in charge of managing all accounts as well as authentication and authorization for the entire Mercari Group.

Nozawa：The founding of Souzoh (another company in Mercari Group) in January of last year kicked off a group-wide movement to launch new services using the Mercari marketplace app as a platform.

As a result, a greater number of services, such as Mercari Shops and Mercoin, use Mercari IDs, and a wider range of information is managed through those IDs. Moreover, the sense of speed and security standards required differs according to each service.

As services with different requirements are being developed and operated in parallel, the role of the IDP Team is to provide support so that users can feel at ease using all features on Mercari.

In other words, I’d go so far as to say that the IDP domain is the core of the future growth of Mercari Group.

The dilemma faced by the IDP Team: “We hope to create an environment that can scale over the medium-to-long term”

ーWhat specific challenges are there in the IDP domain to achieving further growth of the services offered by Mercari Group?

Karino：One problem that is frequently debated is balancing versatility and development resources.

For example, let’s say that a project to launch some sort of new service starts. When that happens, because the product/platform team bases their thinking on the presumption that the service or feature will operate permanently, they want to ensure consistency with the rest of the product.

In particular, the services possessed by IDP are used in many services and features on Mercari, so there is a significant advantage in designing with versatility in mind even when considering the number of resources it will take.

However, taking versatility into account during design requires various extra processes, such as interviewing the product team to understand the ways in which it could possibly be used, considering various design patterns, and organizing each of the advantages and disadvantages, which inevitably necessitates a certain amount of time.

Meanwhile, in reality, because this new project has a clear purpose and a schedule, fundamentally it is difficult to take into detailed consideration use cases that are not directly related to that project.

When that happens, it is very common for projects to fall into a situation where they say, “We understand that it would be better to implement a more versatile design when thinking about the future, but we do not have the time to realize that much on this project.”

Robert：In a similar fashion, there are also debates on a security level.

When it comes to fintech domains such as Merpay and Mercoin, an even higher level of security is required. But if the security is made too robust and requires two or three rounds of authentication, the usability decreases.

What security level should that service be placed at, and to what extent should the usability be considered? To do that, what should the IDP Team create? What should the product team side prepare? And what should the security team do?

These are questions we can’t resolve only within our own team. But it takes time to hold discussions with the security team and the product team and think about how to find the optimal form of authentication and authorization. We struggle to decide whether we should spend time on this discussion now or do it later.

ーSo the IDP Team focuses on taking time to discuss and find the optimal solution.

Robert：Yes, that is true. That said, due to time constraints the IDP Team has had to release services with solutions that aren’t exactly optimal in the past.

Of course, this only happens in cases where the release timing is set in stone and that have past precedents showing that the risk of a problem occurring is low even if the solution is not perfect.

However, the accumulation of such solutions can create technical debt, so the IDP Team does worry about it.

Karino：However, even if for example we are unable to release with a solution that we can say is optimal, if we can design it in a way that we can move it to the ideal form later, then we can release it quickly while still ensuring the (future) versatility.

Moreover, once we have enough features with a certain degree of versatility, we should be able to make use of those even as more and more services are created and the number of things that we want to do increases, so the number of development resources required shouldn’t increase linearly. However, the current state is still a partial solution with respect to that ideal form.

For example, when a client such as Mercari Shops uses a Mercari feature, there is a basic workflow which already exists in which it authenticates and authorizes with an account that is registered to Mercari, issues a token, and then uses that token.

However, the part which manages the permissions of the issued token is still incomplete, and we have not reached a level in which we can make it possible for each product team to autonomously select and use features to respond to requests for using or providing specific features.

Robert：Our goal for the foreseeable future is make it possible to carry out such a series of processes in a stress-free way. We hope to provide a development system that can provide a speedy and accurate ID system even if the organization scales up.

Nozawa：In terms of the future, we hope to be able to make it possible for not only the IDP Team but also the common platform teams to provide APIs and create services and features. We hope to templatize the ID system for standard use cases and make it possible to implement applicable services and features on the product side without consulting with the platform teams.

If the standardization and versatility of the ID system and platform advance, then the teams on the platform side will become able to concentrate on solving medium- to long-term issues. In addition, because the product teams can use what the platform teams have prepared, it should become fairly easy to create services and features.

However, in order to do so, it is essential for the product team to deepen their knowledge and understanding of IDP and the platform. Providing such learning opportunities can also be described as the mission of the IDP Team and the platform teams.

We need to not only create what is right in front of us, but also direct our attention to the importance of initiatives to scale up development over the medium-to-long term for the entire group.

A PM way of thinking: Pursuing the ideal IDP with a sense of vision

ーWith Mercari Group aiming to become a world-class tech company going forward, you’ll undoubtedly continue to release new services and features. How will the Merpay engineering organization respond to such developments going forward?

Robert：First, the most immediate issue is hiring to strengthen the organization. Right now, the IDP Team has a total of 11 people, with seven engineers, three PMs, and one EM. We clearly do not have enough human resources to maintain the ID system for over 20 million monthly active users on Mercari and its related services.

However, that being said, there are still very few engineers in Japan who have experience in the ID and authentication and authorization domains. In particular, to create a system of high versatility as mentioned a moment ago, the engineers must have a long-term perspective, a strong will to develop business, and a project management perspective.

Karino：Ideally, an engineer in this position would be someone who sets a vision for the IDP field, understands multiple internal and external use cases and priorities, and can conceive of practical implementation strategies. And I would also say the ability to communicate those ideas to others is important.

In short, a person who can put forth a vision of the ideal form for IDP, think strategically about what needs to be done and what shouldn’t be done to achieve that vision, and persuasively communicate with the product teams.

If they can do that, then they should be able to pursue the ideal form for IDP based on a wide range of use cases not only for hot projects but also for projects that are still in the planning stages, for example. If they can firmly communicate their vision, then stakeholders including the project members will also definitely agree and combine their efforts to achieve success.

ーYou mentioned that there are still very few engineers in Japan who have experience in the ID and authentication and authorization domains. What do you feel is interesting about undertaking development in this domain?

Karino： It involves not only permissions and authentication and authorization, but also various areas such as security, UX, and the law, so I think it’s interesting that you can deeply dive into domains that you particularly enjoy.
Moreover, in the case of our company, we have a wide range of services and users, so you can learn about various use cases. That would likely be a significant positive for broadening your skills and experience as an engineer.

Robert：Mercari Group advocates the value of “All for One.”
We play an extremely important role in helping members of Mercari Group continue to create good services, and when our system causes some sort of incident, the effect spreads across all of Mercari. When you think about how you are being entrusted with work that has a significant impact not only on the company but on society as a whole, there’s a bit of pressure.

The IDP domain is specialized, and the IDP Team at Mercari has members from nine different countries, including Robert. Mercari’s global environment is also one of its unique points.

Nozawa： Mercari Group will continue to tackle the challenge of becoming a world-class tech company going forward and plans to steadily produce new services.

If we can enhance the improvement of IDP, then we will be able to achieve a high level of usability across the entire Group without having the service development side or the users spend time on authentication and authorization. When that happens, we will become closer to achieving the mission put forth by Merpay of “building trust for a seamless society.”

While this may be a specialized domain, I believe that it is an environment in which engineers who wish to create good services and do influential work can demonstrate their abilities.

Reporting by Kanako Ishikawa
Photography by Yota Akamatsu
Editing by Kotomi Kasai (Editorial Staff)