Google OAuth verification: how UploadPack uses two read-only YouTube permissions

What Google OAuth permissions does UploadPack use?

UploadPack’s optional YouTube connection requests two read-only Google OAuth scopes. youtube.readonly identifies the authorised channel and retrieves its channel baseline. yt-analytics.readonly retrieves selected non-monetary YouTube Analytics reports. Neither scope lets UploadPack upload, edit, schedule or delete videos, change channel settings or access revenue reports.

Key takeaways

• Google OAuth verified for the approved configuration
• youtube.readonly for channel identity and baseline
• yt-analytics.readonly for non-monetary reports
• No upload, editing, deletion or revenue permissions

What Google OAuth verification means

OAuth is the permission system that allows a Google user to grant an application specific access without giving the application the user’s Google password. During connection, Google identifies the app, displays the requested access and asks the user to consent. Verification is Google’s review process for public apps that request applicable user-data scopes. Google reviews the submitted app identity, consent-screen configuration, scope justification, demonstrated use and required policy information. Approval applies to the reviewed project configuration and approved scopes; it is not a general endorsement of UploadPack, a guarantee of security or permission to access anything beyond the consented scopes. UploadPack therefore describes the status as ‘Google OAuth verified’ rather than ‘Google approved’ or ‘officially endorsed by YouTube.’ Verification is still an important trust signal because the public connection has been reviewed for the declared use. It also creates an ongoing obligation: changes to branding, consent configuration or sensitive scopes may require renewed review, and UploadPack cannot inherit approval for a new permission it has not submitted.

Permission one: youtube.readonly

The first permission is `https://www.googleapis.com/auth/youtube.readonly`, described by Google as access to view the user’s YouTube account. UploadPack uses this scope to identify the YouTube channel authorised by the signed-in creator and retrieve a compact channel baseline. In the current product, that baseline can include the official channel title, subscriber count, lifetime view count and number of published videos. These values help the Publishing OS understand the scale and publishing history of the connected channel. They do not give UploadPack control over the account. The scope does not authorise UploadPack to upload a video, edit a title, change a thumbnail, delete content, post a comment, modify captions or alter channel settings. It is also not used to sign the creator into UploadPack generally; account access and YouTube connection are separate decisions. A creator can use non-Google features without connecting a channel. The purpose of this scope is narrow and visible: show the correct channel and provide the baseline context used by the channel-intelligence feature.

Permission two: yt-analytics.readonly

The second permission is `https://www.googleapis.com/auth/yt-analytics.readonly`. Google defines this scope as permission to view YouTube Analytics reports for the creator’s YouTube content. UploadPack uses it to retrieve selected non-monetary performance measures for the authorised channel and chosen reporting period. Depending on the report available and the implemented view, those measures can include views, likes, comments, estimated watch time, average view duration and average percentage viewed. This is different from the channel baseline. The YouTube Data API can identify the channel and provide channel-resource statistics, while the YouTube Analytics API provides report values across a specified period. The scope is read-only and non-monetary. UploadPack does not request the separate monetary analytics scope, so this permission is not designed to retrieve estimated revenue, advertising performance or other monetary reports. It also cannot change analytics data or manage the channel. Its visible purpose is to provide performance context that helps the creator interpret recommendations and decide how a new publishing plan should fit the real channel.

Why UploadPack needs two permissions

The two scopes are not duplicates. They apply to two Google APIs and provide different information. `youtube.readonly` supplies the identity and baseline of the authorised channel. `yt-analytics.readonly` supplies selected performance reports for that creator’s content. Removing the first would make it harder to reliably identify and display the exact channel selected by the signed-in user and would remove the implemented baseline. Removing the second would prevent the app from retrieving the private analytics report used for selected-period performance. Google’s verification guidance requires applications to request the narrowest scopes that allow the implemented user-facing feature to work. UploadPack follows that principle by requesting two read-only scopes rather than a broader management scope. The app does not request permissions in anticipation of speculative future tools. If UploadPack later wanted to publish videos, edit metadata or retrieve monetary reports, it would need new scopes, new product disclosure and, where required, additional verification. The current permission set is deliberately constrained to understanding and displaying the channel, not operating it.

What UploadPack cannot do with these scopes

The most useful way to understand permissions is to list the actions they do not allow. UploadPack cannot publish, schedule, edit or delete videos. It cannot replace thumbnails, change titles or descriptions, edit playlists, write comments, alter captions, manage memberships, change channel settings or access Gmail and Google Drive. It does not receive the creator’s Google password. It does not request the YouTube monetary analytics scope, so the connection is not intended to retrieve revenue or advertising reports. Read-only does not mean that every retrieved value is already public; selected analytics can be private to the channel owner. It means UploadPack can request authorised data but cannot use these scopes to modify the account or content. This distinction is why the Google consent screen should be read carefully. The creator is granting viewing access to specific categories, not control of the channel. Any future feature that required a write action would need a visibly different permission request and could not be silently added under the existing approval.

The connection is optional and consent-led

A creator does not need to connect YouTube to create an UploadPack account, use independent research or build a publishing pack from manually supplied context. The connection is an optional enhancement for people who want channel-aware recommendations and a private analytics view. Before OAuth begins, UploadPack presents an in-product notice explaining the purpose of the connection, the two read-only permissions, the data categories involved and the relevant use of metrics. Google then presents its own consent screen. Consent should be an affirmative choice rather than an assumption hidden inside signup. This separation also protects the meaning of introductory access: connecting YouTube is not a condition for receiving non-Google product features. A creator who declines can continue with channel memory, manual inputs and independent opportunity research. A creator who accepts can later disconnect. Optionality matters because a legitimate feature can still be inappropriate for a particular workflow. Some users may manage client channels, follow an internal security policy or simply prefer not to connect. UploadPack is designed to remain useful in those cases.

How authorised data supports personalisation

Connected metrics are useful only when they improve a visible feature for the user. UploadPack can use relevant parts of the channel baseline and selected-period performance to make a generated publishing pack more appropriate for the connected creator. For example, channel scale, publishing history and average viewing behaviour can provide context when deciding how much background a video needs, how ambitious a format should be or which performance lesson deserves attention. The system should not dump an entire account history into a prompt. It uses the minimum relevant values needed for the specific personalisation, after the creator has accepted the data notice. OAuth access and refresh tokens are never included in AI prompts. Those tokens are credentials used by the server to make authorised Google API requests; they are not useful content for a publishing recommendation and must remain protected. UploadPack also avoids presenting personalisation as certainty. Metrics describe previous channel behaviour. They can improve context, but they cannot prove that a new topic will succeed or replace the creator’s judgement.

Why YouTube metrics do not alter the Opportunity Score

UploadPack separates external opportunity from channel-specific fit. The independent Opportunity Score is intended to describe the strength of the researched idea based on the evidence available for that opportunity. Google-authorised channel metrics remain outside that score. This prevents a large subscriber count or strong historical performance from making a weak topic appear objectively better. It also prevents a new channel from being told that a credible opportunity is poor merely because it has limited history. Channel data answers a different question: how should this creator approach the idea? A topic may have strong demand but require a narrower angle for a developing channel. Another may have modest general demand but fit an established audience or commercial objective unusually well. Keeping the layers distinct makes the recommendation easier to inspect. The creator can see the opportunity evidence, the channel context and the resulting fit judgement rather than receiving one opaque number that blends them together. This boundary is both analytically useful and important to UploadPack’s stated data use.

Storage, disconnection and revocation

A server-side OAuth connection may use an access token for current requests and a protected refresh token so the creator does not have to reconnect whenever the short-lived access token expires. UploadPack’s product documentation states that tokens remain server-side and are excluded from AI prompts. The app may also retain an account-specific display snapshot needed for the channel-intelligence feature and saved personalisation. Creators should have practical control over that relationship. Disconnecting inside UploadPack prevents the stored connection and snapshot from being used for future pack personalisation. The creator can also manage third-party access through the security and permissions area of the Google Account, where access can be revoked directly. Revocation tells Google to stop honouring the authorisation. Account and data-deletion controls provide a separate route for removing stored UploadPack information. These actions have different meanings, so clear product language matters: disconnect the feature, revoke Google access and delete account data should not be presented as though they are the same button.

A practical checklist before connecting

Before granting access, confirm that the Google consent screen names UploadPack and shows only the expected read-only YouTube permissions. Read the in-product notice and decide whether the benefit—channel baseline, selected-period analytics and more relevant pack personalisation—is useful for your workflow. Remember that Google OAuth verification confirms the reviewed configuration; it does not mean Google recommends the product or guarantees its output. After connecting, check that the Publishing OS displays the correct channel and the expected analytics period. Do not continue if an unfamiliar account or unexpected permission appears. When working with a client channel, make sure the person authorising access has the right to do so and that the connection fits the client’s data policy. Review connected apps periodically and remove access that is no longer needed. This simple process keeps the decision informed. The core promise is straightforward: UploadPack can read a limited set of channel and non-monetary analytics data to improve its user-facing publishing intelligence, while control of the YouTube channel remains with the creator.

Official and first-party references

• Google: OAuth 2.0 for YouTube web applications
• Google: YouTube Analytics OAuth scope definitions
• Google: YouTube Analytics reports.query reference
• Google Account Help: review or remove third-party access

Google OAuth and YouTube permission questions