Publishing to YouTube without ever touching an API key

Uploading a video to YouTube usually means juggling credentials. Many tools ask you to paste in an API key or a client secret. Those strings are long, ugly, and dangerous if they leak. We do not want you to handle them. When you connect a channel to Autoretto, you never see a key. You never copy one. You never paste one. The whole process happens through a standard Google OAuth grant. You click a button, approve what we ask for, and that is it.

The grant works like this. You open our settings page and choose Connect channel. Google opens a consent screen. The screen lists the exact permissions we request. We ask for the ability to upload videos and manage the videos we upload. We do not ask for profile data, contacts, or anything else. You select the channel you want to use. Then Google hands us a one-time authorization code. This code is good for seconds. It gets sent directly to our server, never through your browser.

Our server exchanges that code for two things: an access token and a refresh token. The access token is short-lived. Google sets it to expire roughly an hour after it is issued. The refresh token is longer-lived. It is the key to getting new access tokens later. We do not write the refresh token to a log. We do not send it to any client. We encrypt it before storage. The encryption key lives in a separate vault. Each channel's token sits in its own database record, isolated from every other channel.

Now fast-forward to upload time. The render queue has finished a video. The policy gate has passed it. A scheduled job wakes up. It looks up the channel's refresh token, decrypts it in memory, and uses it to call Google's token endpoint. That call returns a brand-new access token. We never store that access token anywhere. We use it immediately to upload the video file. The upload completes, and the access token becomes garbage. It expires on its own within the hour.

This design keeps your channel safe in several ways. No API key ever appears in your browser's developer tools. No client secret ships in our front-end code. The refresh token is encrypted at rest, and the encryption key is separate. Even if the database were copied, the token would be unreadable. And because the access token lives for only a few minutes, there is no long-lived credential floating around the network. The worst case is the one-time code, which expires in seconds.

Google also lets you revoke access. If you delete the connection from your Google account, our refresh token stops working. If you disconnect from our side, we delete the token. If the token expires due to long inactivity, the next upload fails cleanly. We send you an email and tell you to reconnect. Reconnecting is another OAuth grant. You do not re-enter a password. Google handles the authentication. The whole thing takes about thirty seconds.

This token flow sits inside a larger pipeline. Autoretto generates the audio with Suno, the artwork and copy with Gemini, and optional motion with Sora. It renders a beat-synced video, then runs quality and policy checks. The upload is the last step, and it is the only step that touches YouTube. By minting the access token at that exact moment, we keep the surface area small. There is no stored session to renew in the background, no standing credential that could be leaked.

We built Autoretto to be hands-off. You approve a channel once, and the system handles every release from there. You stay in control, because the access is narrow and revocable. You never have to open a developer console. You never have to rotate a key. The secret stays in a vault, encrypted, until the second it is needed. That is how a connected channel publishes without the creator ever handling an API key.