google oauth verification
How Influency uses
Google OAuth and APIs.
This page is written for Google's OAuth verification reviewers. It lists every Google endpoint the product calls, every scope it requests, why each one is needed, and exactly what happens to the data.
1. What the app is
Influency is publishing software for content creators. A creator uploads one video or image, chooses which social networks it should go to, and Influency publishes that same piece of content to each one, with a caption, title, hashtags and schedule written for each network. Google Drive is offered as a source for files the creator already has; YouTube is offered as one of the publishing destinations, alongside Instagram, TikTok, Facebook and Threads.
It is not a social network, not a marketplace, not a file-sharing product, and not an advertising product. There is no user-to-user interaction and no content discovery.
2. The OAuth flow
Standard OAuth 2.0 authorization code flow against Google's authorization server. The app is registered as a confidential web application: the client secret is held only in server environment variables and never reaches the browser. The authorization code is exchanged server-side, the tokens are encrypted immediately, and the state parameter is verified against an httpOnly cookie to prevent CSRF.
GET /api/connections/<provider>/start → accounts.google.com/o/oauth2/v2/auth
POST /api/connections/<provider>/callback → oauth2.googleapis.com/token
3. Every Google endpoint we call
This is the complete list. There are nine calls, across two APIs.
| Method | Endpoint | Why we call it |
|---|---|---|
| POST | https://oauth2.googleapis.com/token | Exchanges the authorization code for tokens, and refreshes the access token before it expires. No user data. |
| GET | https://www.googleapis.com/youtube/v3/channels?part=snippet&mine=true | Called once, at connection time, to read the channel title and thumbnail so the connection card can show the real channel. Reads only the signed-in user's own channel. |
| POST | https://www.googleapis.com/upload/youtube/v3/videos?uploadType=resumable&part=snippet,status | Creates a resumable upload session for a video the creator explicitly submitted for publishing. |
| PUT | (session URL returned above) | Uploads the video bytes the creator uploaded to Influency. No other content is ever sent. |
| GET | https://www.googleapis.com/youtube/v3/videos?part=status,processingDetails | Polls the processing state of the video we just uploaded. |
| GET | https://www.googleapis.com/youtube/v3/videos?part=statistics | Reads view/like/comment counts for videos we published, to show the creator their own performance. |
| GET | https://www.googleapis.com/drive/v3/about | Called once, at connection time, to read the account display name and email address for the connection card. |
| GET | https://www.googleapis.com/drive/v3/files?q=... | Lists the user's video and image files so the creator can pick one. The query filters to media types only and excludes the trash. |
| GET | https://www.googleapis.com/drive/v3/files/{fileId}?alt=media | Downloads the single file the creator selected. This is the only file ever downloaded. |
4. Scope-by-scope justification
https://www.googleapis.com/auth/drive.readonly
Classification: Sensitive
Lets a creator pull a video or image they already have in Google Drive straight into Influency, instead of downloading it to their computer and re-uploading it by hand.
- Used only after the creator explicitly connects their Drive and picks a file from the list shown in the app.
- The file list is filtered server-side to video and image types (video/*, image/jpeg, image/png, image/webp, image/gif) and to items not in the trash.
- We download exactly one file per explicit user action.
- We never create, edit, move, share, or delete anything in Drive. No files.create, files.update or files.delete calls exist in the codebase.
- After download the file lives in our own storage and no longer depends on Drive. Disconnecting removes the access token immediately.
https://www.googleapis.com/auth/youtube.upload
Classification: Sensitive
Lets a creator publish a video to their own YouTube channel as a Short, from the same place they publish to the other networks, with a title and description written for YouTube.
- Only uploads videos the creator uploaded to Influency and explicitly submitted for publication.
- Every upload is created with privacyStatus = private by default, so content is never made public without the creator changing that setting themselves.
- No call is made to modify or delete any video that Influency did not upload.
- No comment, subscription, playlist, rating, live-broadcast or analytics-of-others functionality exists.
https://www.googleapis.com/auth/youtube.readonly
Classification: Non-sensitive
Reads the creator's own channel title and thumbnail so the connection card shows the real channel instead of a generic logo.
- Called once, immediately after the creator connects the channel.
- Only part=snippet and mine=true are requested: channel title and thumbnail URL.
- No public metrics, no subscriber list, no video list of the channel or of any other channel.
5. What we store from Google
| Data | Where | When it is deleted |
|---|---|---|
| Access token | Encrypted (AES-256-GCM) in Postgres, scoped to the workspace | Deleted when the creator disconnects or deletes the account |
| Refresh token | Encrypted (AES-256-GCM) in Postgres | Deleted when the creator disconnects or deletes the account |
| Channel title and thumbnail URL | Postgres, on the workspace connection row | Deleted when the creator disconnects |
| Drive account display name and email | Postgres, on the workspace connection row | Deleted when the creator disconnects |
| Videos and images the creator uploaded | Supabase Storage, in the workspace folder | Removed when the creator deletes the item or the account |
6. What Influency never does with Google data
- We never sell, rent, license or share user data with advertisers, data brokers or ad networks.
- We do not use Google APIs, or any other API, to generate images or video with artificial intelligence.
- We do not generate, produce, distribute or host non-consensual intimate imagery (NCI).
- We do not use Google Drive as a storage backend for our users. Drive is only a source of files to read from.
- We do not read, index, profile or train models on anything from a creator's Drive. The file query is restricted to media types and to the single file the creator selects.
- We do not human-review, moderate, or pre-screen user content. Content is only accessed to publish it.
- We do not use the YouTube Data API to read any channel other than the one the creator authorized.
- We do not publish content automatically without an explicit action by the creator.
7. Security
- OAuth tokens are encrypted at rest with AES-256-GCM, using a random 12-byte IV and a per-token authentication tag.
- The OAuth client secret lives only in server environment variables. It is never bundled, logged, or sent to the browser.
- All traffic is over HTTPS. Every database write is scoped to the authenticated workspace, with row-level security plus server-side ownership checks.
- The OAuth state parameter is compared against an httpOnly, SameSite cookie and deleted on use, which blocks cross-site request forgery.
- Access tokens are refreshed automatically before expiry, and a creator can revoke access at any time from the Integrations page, which deletes the stored token immediately.
8. How a reviewer can test this
You do not need to contact us. Everything below is self-serve on the live site.
- Open https://ideiabrena.vercel.app/login and sign in, or create an account.
- Go to Integrations and click Connect on Google Drive and/or YouTube.
- The Google consent screen appears. The brand should show as INFLUENCY once branding verification is approved.
- Authorize. You are returned to Influency, and the connection card immediately shows the real account name and avatar fetched from the API.
- Go to Create publication, choose the Da nuvem (From the cloud) tab, select Google Drive, and you will see the list of media files in the connected Drive. Pick one to import it.
- Or go to Create publication, choose Subir novo (Upload), upload a short video, select YouTube as a destination, write a title and description, and publish.
Test account credentials are submitted separately through the verification form in the Google Cloud console.
9. Legal
Privacy policyTerms of serviceData deletion request
10. Demo video
TODO — replace with the unlisted demo video link before submitting for review.
The video should show, in one continuous take: the Integrations page, the Google consent screen, a successful Drive connection, the Drive file picker inside the publish wizard, and a YouTube upload. An unlisted YouTube link is fine.