we never touch your api key. here's how.

When you connect your YouTube channel to Autoretto, the first thing we do is ask Google for permission. You see a consent screen. You click allow. That's the one and only time you ever have to do it. We never ask for your password. We never ask for an API key. What happens next is a simple exchange that keeps your channel secure and your workflow automatic.

Google sends back a code. We take that code and trade it for two tokens. One is a short-lived access token that expires in an hour. The other is a refresh token that lasts much longer unless you revoke it. We encrypt the refresh token and store it in a secure database, tied specifically to your channel. The access token we don't keep at all. We throw it away right after we use it for the initial handshake.

From then on, every time Autoretto needs to upload a video, it goes through a server-side process. Our scheduler triggers the upload job. A backend service pulls your encrypted refresh token from storage, decrypts it, and asks Google for a fresh access token. That new token lives only for the duration of the upload. It is never written to disk. Once the video is published, the access token is discarded.

Why does this matter? Because you never have to generate or copy-paste a long API key. You never have to worry about that key leaking in a log file or being accidentally committed to a public repo. The only thing you gave us is permission via OAuth, and you can revoke that permission at any time from your Google account settings. No muss, no fuss.

The refresh token is the real power here. It lets us act on your behalf indefinitely, but only for the specific scopes you approved during setup. We store it encrypted using a key that only our backend knows. That key rotates periodically. Even if someone accessed the database, they would see a blob of random bytes, not your token.

And we add one more layer. Before minting the short-lived access token, we double-check that your channel is still connected and that you haven't revoked permission. If you have, the upload fails with a clear error message. You then get a notification to reconnect your channel through a simple OAuth flow again. No data loss, no mystery.

The result is a system where you own your channel and your content, but you don't have to manage cryptographic secrets. Autoretto handles the token lifecycle for you. You focus on making music. We focus on getting it to YouTube safely and automatically.