YouTube: passing OAuth verification is not the end

YouTube was the network where I learned the difference between “approved” and “done”.

Check one: OAuth verification

To let other people connect their YouTube channel, Clienzo asks for two scopes: one to upload videos and one to read basic channel and video data. Both are classed as sensitive, which means Google verifies the app before strangers can use it.

That review wanted:

• a demo video showing exactly how each scope is used,
• a test account the reviewers could sign in with, working without a paid plan,
• a privacy policy that matches what the app actually does.

The last one is easy to get wrong. My first policy did not mention that Clienzo reads video statistics, even though the analytics do exactly that. A mismatch between the policy and the API calls is a common reason for rejection, so I rewrote that section before submitting.

There was a round of follow-up questions, and the verification completed.

Check two: the API audit

Here is the part most people miss. Passing OAuth verification does not let you publish public videos.

Any API project created after July 2020 has every upload locked to private, whatever privacy setting the app sends, until it passes a separate YouTube API compliance audit. The form for it is titled “Audit and Quota Extension”, which makes it sound optional. It is not.

Because of this, Clienzo’s YouTube publisher reads back the privacy status YouTube actually applied after each upload. If the video was forced to private, the post’s result says so — instead of reporting “published” for a video nobody can see.

Where it stands

The audit was approved in September and the OAuth review completed in October. Nothing is pending on the Google side now.

The lesson

Read the platform’s docs for the word “audit” before you plan a launch date. With most platforms, being allowed to connect and being allowed to publish publicly are separate approvals.

Next: the smaller networks, where the quirks were stranger.