- scope granted
- youtube.uploadupload & schedule the videos you approve — the only write access in the grant
- scope granted
- youtube.readonlyread-only across your channel's own resources. It cannot write anything. We call it once, channels.list(mine=true), to show you which channel is connected.
- not requested
- passwordGoogle never issues one to an app
- not requested
- yt-analytics-monetary.readonlythe revenue scope. Your earnings stay outside the grant.
- not requested
- yt-analytics.readonlythe analytics scope. Every view and retention graph stays outside the grant.
- not requested
- …/auth/youtubethe manage scope. We cannot edit, unlist or delete anything already on your channel.
- token at rest
- sealed-box encryptedlibsodium; the decryption key lives in env/KMS, never in the database
- token check
- verified dailythe refresh token is exercised against Google every morning; a revoked grant flips the channel to expired and you are told
- database
- row-level securityon every table — a workspace can only ever read itself
- audit log
- append-onlywho did what, forever — no edits, no deletes
- master files
- sha-256hashed in your editor's browser as it streams, size-checked against S3 on arrival, and re-hashed server-side for masters up to 512 MB — a mismatch rejects. Original bytes, never transcoded.
- disconnect
- two pressesDisconnect on the card, then Disconnect again in a dialog that names the channel — and the token is revoked with Google and the ciphertext destroyed, which happens even if the revoke call fails
- sessions
- Clerk-managedsign-in runs through Clerk; credentials go to Clerk, never to us
- passwords stored
- nonethere is no password to see — OAuth for YouTube, Clerk for sign-in
