how a connected channel publishes without api keys
When you connect your YouTube channel to Autoretto, you never give us an API key. You don't paste a secret string or manage credentials. Instead, you go through a one-time Google OAuth flow. It looks like any standard "Sign in with Google" button. You choose the channel you want to connect, grant the permissions we need, and that is it. No copying and pasting tokens, no worrying about expiration.
The permissions we ask for are specific. We need to upload videos to your channel, update video metadata, and maybe read basic analytics later. Google shows you exactly what we are requesting. You approve, and Google returns an authorization code to our server. That code is exchanged for two tokens: an access token that lives for about an hour, and a refresh token that lasts much longer.
The refresh token is the key piece. We encrypt it using industry-standard practices and store it in our database, tied to your channel. We never expose it to you or anyone else. It lives only on our backend, behind multiple layers of access control. If someone were to compromise our database, the encrypted tokens would be useless without the decryption keys stored separately.
When it is time to publish your video, our system wakes up. It pulls your channel profile, retrieves the encrypted refresh token, and decrypts it in a secure memory space. It then contacts Google's servers, presents the refresh token, and gets a fresh access token. This access token is valid for about an hour. We use it immediately to upload the video, set the title, description, and publish it according to your schedule.
The access token never appears in your browser. It is never stored anywhere long-term. After the upload is complete, we discard it. The refresh token goes back into its encrypted vault. The whole process is automated and invisible. When you check your channel later, the video is there, live, without you ever having seen or handled an API key.
This design is about security and convenience. You only grant permission once. After that, you can forget about technical details. If the refresh token ever gets revoked (say, you change your password or disconnect the app from Google's settings), our system will notice at the next upload attempt. You will get a notification to reconnect, and the OAuth flow will happen again. It is a simple off-ramp that protects your account.
Under the hood, we use Google's official client libraries and follow their best practices. Tokens are rotated if needed. We monitor for unusual activity. The encryption uses AES-256-GCM. The decryption keys are rotated regularly and stored in a hardware security module. We do everything to make sure your channel stays yours, without making you jump through hoops.
So when your next video goes out, remember: no API keys were handled by you. Just a one-time OAuth click, a securely stored refresh token, and a short-lived access token minted exactly when needed. That is how Autoretto publishes without exposing your credentials.