One Google consent screen, then Autoretto handles the rest

When you connect a YouTube channel to Autoretto, you do not create an API key. You do not look for a long string that starts with AIza. You do not paste anything into a settings page. The connection is handled through OAuth. OAuth is the system Google uses to let outside apps work with your account without exposing your password. The flow runs once, and it leaves no extra key lying around in your dashboard.

You click Connect on the channel page. Your browser moves to a Google-owned page. The page shows a list of permissions. Autoretto asks to upload videos, edit metadata, and read performance numbers. These are the only things the platform needs. You choose the account, sign in, and click Allow. Google does not reveal your password to Autoretto. It never shares it with the app.

The allowance is granted in the form of a code. Google redirects the browser back to Autoretto with that code in the address. The code is short and only lives for a few minutes. Autoretto's server picks it up and sends it, along with the client ID and secret, to Google's token endpoint. Google responds with two tokens. One is an access token. The other is a refresh token.

Access tokens are like hotel room keys. They work for a short period, often one hour, and they give access to a defined set of actions. Autoretto receives one at connection time, but it is not the token that matters later. The important token is the refresh token. It lasts much longer, until someone revokes it. The refresh token is what lets Autoretto ask Google for new access tokens over the coming months or years.

So the refresh token carries the responsibility. Autoretto does not leave it in plain text. It is encrypted and stored with the channel record. The key that can decrypt it is kept in a separate secret vault. The vault is managed through a cloud provider with hardware encryption. Access to the decryption key is restricted to the small service that handles publishing. Every attempt to read the token is logged. Contractors and support staff do not have a way to decrypt it.

Here is what happens when the scheduler says it is time to go live. The publishing service pulls up the channel record. It decrypts the refresh token for that channel only. It calls Google's token endpoint and receives a new access token. That access token is valid for a short window, measured in minutes or an hour depending on Google's setting. The upload request uses it immediately. The video goes up. The token is discarded. It was never sent to the browser, never stored in a database, never written to disk.

The whole chain stays quiet if the channel remains connected. What happens if you cut the connection? Open your Google account settings, find the app you no longer want, and revoke it. Google invalidates the refresh token. The next scheduled publish fails because the refresh token is dead. The pipeline catches the auth error, pauses the channel, and emails you. No key needs to be deleted on your side. To reconnect, you start the OAuth flow again. That is the only step.

There is no API key to leak. There is no private string sitting in an environment variable that somebody might copy. OAuth tokens are revocable and scope-limited. The refresh token is encrypted at rest and never handled in the client. Short-lived access tokens appear only in the few seconds of an upload call. That is how a creator can run an automated channel and never spend a second thinking about credentials.