How a connected channel publishes without API keys
A creator connects their YouTube channel to Autoretto exactly once. They never see, copy, or paste an API key. They never store a secret in a dotenv file or worry about an exposed credential. The whole process happens in a browser window, and after that, the platform handles every subsequent upload on its own.
The first step is a standard Google OAuth flow. The creator clicks the Connect button, logs into their Google account, and grants the requested permissions. Autoretto asks for access to manage the YouTube channel. That is it. No token is shown on screen. No key is handed to the creator. The browser redirects back to Autoretto with an authorization code, which the server immediately exchanges for a refresh token and an initial access token.
The access token expires quickly, usually within an hour. That is by design. The refresh token, on the other hand, lasts indefinitely unless the user revokes it. Autoretto encrypts that refresh token before storing it in its database. The encryption key lives on a separate service, never on disk alongside the tokens. Each channel gets its own encrypted record. There is no shared pool of credentials.
When it is time to publish a video, the Autoretto server retrieves the encrypted refresh token for that channel. It decrypts it, then exchanges it for a fresh access token. This new access token is short-lived and valid only for that specific upload operation. The server uses it to post the video metadata, the audio file, and the thumbnail to YouTube. Once the upload completes, the access token is discarded. The creator never touches it.
This design eliminates the most common security risks of API key management. There is no key to accidentally commit to a git repository. There is no key to leak in a log file or a support ticket. The only holder of the token is the server, and even there it is encrypted at rest. The creator does not need to rotate keys or monitor usage dashboards. Their part is done after the initial OAuth consent.
The system also handles edge cases. If a refresh token expires because the creator changed their password or revoked access, Autoretto detects that on the next scheduled upload and sends a notification. The creator reconnects with a new OAuth grant, and the cycle continues. No data is lost. The upload queue pauses until the token is refreshed.
For creators, this simplicity means they can focus on making music. They set up a channel connection once, schedule their releases, and let Autoretto run. There is no ongoing credential maintenance. No fear of accidentally exposing a secret. Just one click to connect and then the platform does the rest.