quorlasocial/docs/google-app.md

Google apps: Quorla (YouTube + Google Business Profile)

Two Google Cloud projects, both owned by dev@metatroncubesolutions.com:

• YouTube → project Quorla (quorla, number 275320055192), described below.
• Google Business Profile → project GMB Audit (gmb-audit-489406), which was already approved for the Business Profile API (300 requests/minute). A new access request for quorla was declined because an approved project already exists, so Quorla uses GMB Audit for Business Profile. Its consent screen was renamed to Quorla (logo, links, domain quorlasocial.com), scopes openid / userinfo.email / business.manage, test users dev@ and the Gmail, and a new web client "Quorla GBP (app.quorlasocial.com)" with redirect https://app.quorlasocial.com/oauth/gbp/callback. Its keys are GBP_CLIENT_ID / GBP_CLIENT_SECRET in .env.

YouTube project (Quorla)

• Google Cloud project Quorla (ID quorla, number 275320055192) in the metatroncubesolutions.com organization, created with dev@metatroncubesolutions.com.
• APIs enabled: YouTube Data API v3, My Business Account Management API, My Business Business Information API, Google My Business API. No billing account needed; all are free within quota.
• OAuth consent screen (Google Auth Platform): app name Quorla, logo branding/quorla-icon-1024.png, support and developer contact dev@metatroncubesolutions.com, home https://app.quorlasocial.com, privacy /privacy, terms /terms, authorized domain quorlasocial.com. Audience External, publishing status Testing.
• Scopes: openid, userinfo.email, business.manage (non-sensitive); youtube.upload, youtube.readonly (sensitive). No restricted scopes, so no paid security assessment is needed.
• Test users (only these can connect while in Testing; max 100): dev@metatroncubesolutions.com, metatroncubesoftwaresolutions@gmail.com. Add each client's Google account here until the app is verified.
• OAuth web client "Quorla web (app.quorlasocial.com)" with redirect URIs https://app.quorlasocial.com/oauth/youtube/callback and https://app.quorlasocial.com/oauth/gbp/callback. Its ID and secret are in the PC's .env as YOUTUBE_CLIENT_ID/SECRET (GBP_* now point to the GMB Audit client); copy those four lines to the server's .env, or enter them in Quorla → Connections → Set up. Google shows the secret only once; if it is lost, add a new secret on the client in Google Cloud.

Still to do

1. Business Profile API access — done by reusing the approved GMB Audit project (see above).
2. Verify quorlasocial.com in Google Search Console — done 2026-10-21 (domain property, owner dev@; DNS TXT google-site-verification=… on the Hestia server — keep it).
3. After deploy: publish the app (Audience → Publish app) and submit verification (sensitive YouTube scopes): Google asks for a demo video of the sign-in and how each scope is used.
4. YouTube API audit (free form) to lift the 10,000 units/day quota and the private-only upload limit.

Verification submission (paste-ready)

App purpose (both projects):

Quorla (https://quorlasocial.com) is a social media management tool for marketing agencies. An agency admin connects a client's Google account on Quorla's Connections page. The team prepares posts in Quorla; an admin reviews and approves the exact post, and Quorla publishes it at the scheduled time. Nothing is posted without that approval. Tokens are encrypted at rest and deleted when the account is disconnected.

Quorla project, scope justifications:

• youtube.upload: Upload the video an agency admin approved in Quorla to the connected channel, with the title, description, visibility and "made for kids" setting chosen on the post screen. Only approved posts are uploaded.
• youtube.readonly: Show which channel is connected (name, handle, avatar, subscriber count) on the Connections page, so the agency posts to the right channel, and link to the uploaded video afterwards.

GMB Audit project, scope justification:

• business.manage: List the business locations the connected account manages so the admin can pick the client's location, and publish approved "updates" (local posts with text, photo and an optional button) to that location.

Demo video (one recording, uploaded to YouTube as Unlisted; link it in both forms). Use English and show the browser's address bar so the project's OAuth client ID is visible in the consent URL:

1. quorlasocial.com homepage → privacy policy link → Sign in at app.quorlasocial.com.
2. Connections → pick a client → YouTube → Connect → Google account chooser → consent screen showing Quorla and the YouTube scopes → Allow → back in Quorla, channel shown as connected.
3. Publishing → New post → upload a vertical video → caption → tick YouTube → title, visibility → Save as draft → Approve → post publishes → open the video on YouTube.
4. Connections → Google Business Profile → Connect → consent screen (business.manage) → choose the location.
5. New post with a photo → tick Google Business Profile → button "Learn more" → Approve → open the update on Google.
6. Connections → Disconnect, to show tokens can be removed.