Connected channels publish without you handling API keys

When you connect a YouTube channel to Autoretto, you are not handing over a password or an API key. You never copy a client secret or paste it into a config file. Instead, you complete a standard Google OAuth flow. That flow is the same one you use to sign in with Google on any website. The difference is that Autoretto asks for permission to manage your YouTube channel. You approve that permission one time, and then the platform can publish on your schedule.

Here is the sequence in more detail. You click a button that sends you to Google's consent screen. The screen lists the exact scopes Autoretto needs. Those scopes include uploading videos, reading basic channel metadata, and managing your own videos. They do not include deleting videos or changing channel settings. You sign in and click Allow. Google then redirects you back to Autoretto with a short-lived authorization code. That code is good for a few minutes, and it can be exchanged exactly once for tokens.

The token exchange happens on our server, not in your browser. Google takes the authorization code and returns two things. The first is an access token. It is valid for about one hour. The second is a refresh token. It is valid for months or longer. The access token is what your browser would normally use to make API calls. But we do not want to expose it to the client side. So the access token stays on the server, and it is never sent to your browser at all.

The refresh token is the long-term credential. It is what lets Autoretto act on your behalf after you leave the consent screen. We store it in a database, but not in plain text. The token is encrypted with a key that lives in a separate secret management service. That way, a database leak does not expose working tokens. Even if an attacker got both the database and the encryption key, they would still need to know which encryption algorithm and mode we use. We also rotate that encryption key on a regular schedule.

At upload time, the server follows a strict sequence. It loads the encrypted refresh token for the channel that needs a new video. It decrypts the token, then sends it to Google's token endpoint. That endpoint returns a fresh access token, usually valid for 3600 seconds. The server takes that access token and makes a single call to the YouTube Data API to upload the video file. Once the upload finishes, the access token is thrown away. It is never stored on disk or in memory longer than necessary.

This setup protects both the creator and the platform. The refresh token is limited to the channel you connected. It cannot access your email, your calendar, or your other YouTube accounts. The OAuth scopes define that boundary, and Google enforces it. A refresh token is bound to a specific client ID, which is Autoretto's OAuth client. It is also bound to the user account that approved it. That means the token cannot be replayed from a different application or a different user context. When the access token is minted, it carries the same scopes. So every upload is a narrow, specific action. There is no master key that can do anything.

Refresh tokens do not live forever. Google can revoke them for a few reasons. The most common is that the creator changes their Google password. Another is that they remove Autoretto from their connected apps list. We also handle the case where the refresh token simply becomes invalid after a long period of inactivity. When any of that happens, the next upload attempt returns an authorization error. Our system catches that error and pauses the channel automatically. You get an email with a link to reconnect. The link starts the same OAuth flow you did the first time, and once you grant permission again, the channel is back online.

The beauty of this design is that the creator only interacts with the system once. They connect their channel, approve the scopes, and then walk away. From that point on, every upload is handled by server-side code that mints tokens on demand. The creator never sees a client secret. They never have to paste a key into a terminal. They never have to worry about a token expiring mid-upload. The platform takes that burden, and it does it quietly in the background.