# Google apps: Quorla (YouTube + Google Business Profile)

Two Google Cloud projects, both owned by dev@metatroncubesolutions.com:
- **YouTube** → project **Quorla** (`quorla`, number 275320055192), described below.
- **Google Business Profile** → project **GMB Audit** (`gmb-audit-489406`), which was **already approved** for the Business
  Profile API (300 requests/minute). A new access request for `quorla` was declined because an approved project
  already exists, so Quorla uses GMB Audit for Business Profile. Its consent screen was renamed to **Quorla** (logo,
  links, domain quorlasocial.com), scopes openid / userinfo.email / business.manage, test users dev@ and the Gmail, and a
  new web client **"Quorla GBP (app.quorlasocial.com)"** with redirect https://app.quorlasocial.com/oauth/gbp/callback.
  Its keys are `GBP_CLIENT_ID` / `GBP_CLIENT_SECRET` in `.env`.

## YouTube project (Quorla)

- Google Cloud project **Quorla** (ID `quorla`, number 275320055192) in the **metatroncubesolutions.com** organization, created with
  dev@metatroncubesolutions.com.
- APIs enabled: YouTube Data API v3, My Business Account Management API, My Business Business Information API,
  Google My Business API. No billing account needed; all are free within quota.
- OAuth consent screen (Google Auth Platform): app name Quorla, logo `branding/quorla-icon-1024.png`, support and
  developer contact dev@metatroncubesolutions.com, home https://app.quorlasocial.com, privacy /privacy, terms /terms,
  authorized domain quorlasocial.com. Audience **External**, publishing status **Testing**.
- Scopes: openid, userinfo.email, business.manage (non-sensitive); youtube.upload, youtube.readonly (sensitive).
  No restricted scopes, so no paid security assessment is needed.
- Test users (only these can connect while in Testing; max 100): dev@metatroncubesolutions.com,
  metatroncubesoftwaresolutions@gmail.com. Add each client's Google account here until the app is verified.
- OAuth web client "Quorla web (app.quorlasocial.com)" with redirect URIs
  https://app.quorlasocial.com/oauth/youtube/callback and https://app.quorlasocial.com/oauth/gbp/callback.
  Its ID and secret are in the PC's `.env` as YOUTUBE_CLIENT_ID/SECRET (GBP_* now point to the GMB Audit client); copy those four lines
  to the server's `.env`, or enter them in Quorla → Connections → Set up. Google shows the secret only once; if it is
  lost, add a new secret on the client in Google Cloud.

## Still to do
1. ~~Business Profile API access~~ — done by reusing the approved GMB Audit project (see above).
2. **Verify quorlasocial.com in Google Search Console** (DNS TXT record) — required before Google verifies the app.
3. After deploy: **publish the app** (Audience → Publish app) and submit **verification** (sensitive YouTube scopes):
   Google asks for a demo video of the sign-in and how each scope is used.
4. **YouTube API audit** (free form) to lift the 10,000 units/day quota and the private-only upload limit.