66 lines
5.2 KiB
Markdown
66 lines
5.2 KiB
Markdown
# Google apps: Quorla (YouTube + Google Business Profile)
|
|
|
|
Two Google Cloud projects, both owned by dev@metatroncubesolutions.com:
|
|
- **YouTube** → project **Quorla** (`quorla`, number 275320055192), described below.
|
|
- **Google Business Profile** → project **GMB Audit** (`gmb-audit-489406`), which was **already approved** for the Business
|
|
Profile API (300 requests/minute). A new access request for `quorla` was declined because an approved project
|
|
already exists, so Quorla uses GMB Audit for Business Profile. Its consent screen was renamed to **Quorla** (logo,
|
|
links, domain quorlasocial.com), scopes openid / userinfo.email / business.manage, test users dev@ and the Gmail, and a
|
|
new web client **"Quorla GBP (app.quorlasocial.com)"** with redirect https://app.quorlasocial.com/oauth/gbp/callback.
|
|
Its keys are `GBP_CLIENT_ID` / `GBP_CLIENT_SECRET` in `.env`.
|
|
|
|
## YouTube project (Quorla)
|
|
|
|
- Google Cloud project **Quorla** (ID `quorla`, number 275320055192) in the **metatroncubesolutions.com** organization, created with
|
|
dev@metatroncubesolutions.com.
|
|
- APIs enabled: YouTube Data API v3, My Business Account Management API, My Business Business Information API,
|
|
Google My Business API. No billing account needed; all are free within quota.
|
|
- OAuth consent screen (Google Auth Platform): app name Quorla, logo `branding/quorla-icon-1024.png`, support and
|
|
developer contact dev@metatroncubesolutions.com, home https://app.quorlasocial.com, privacy /privacy, terms /terms,
|
|
authorized domain quorlasocial.com. Audience **External**, publishing status **Testing**.
|
|
- Scopes: openid, userinfo.email, business.manage (non-sensitive); youtube.upload, youtube.readonly (sensitive).
|
|
No restricted scopes, so no paid security assessment is needed.
|
|
- Test users (only these can connect while in Testing; max 100): dev@metatroncubesolutions.com,
|
|
metatroncubesoftwaresolutions@gmail.com. Add each client's Google account here until the app is verified.
|
|
- OAuth web client "Quorla web (app.quorlasocial.com)" with redirect URIs
|
|
https://app.quorlasocial.com/oauth/youtube/callback and https://app.quorlasocial.com/oauth/gbp/callback.
|
|
Its ID and secret are in the PC's `.env` as YOUTUBE_CLIENT_ID/SECRET (GBP_* now point to the GMB Audit client); copy those four lines
|
|
to the server's `.env`, or enter them in Quorla → Connections → Set up. Google shows the secret only once; if it is
|
|
lost, add a new secret on the client in Google Cloud.
|
|
|
|
## Still to do
|
|
1. ~~Business Profile API access~~ — done by reusing the approved GMB Audit project (see above).
|
|
2. ~~Verify quorlasocial.com in Google Search Console~~ — done 2026-10-21 (domain property, owner dev@; DNS TXT `google-site-verification=…` on the Hestia server — keep it).
|
|
3. After deploy: **publish the app** (Audience → Publish app) and submit **verification** (sensitive YouTube scopes):
|
|
Google asks for a demo video of the sign-in and how each scope is used.
|
|
4. **YouTube API audit** (free form) to lift the 10,000 units/day quota and the private-only upload limit.
|
|
|
|
## Verification submission (paste-ready)
|
|
|
|
**App purpose (both projects):**
|
|
> Quorla (https://quorlasocial.com) is a social media management tool for marketing agencies. An agency admin connects
|
|
> a client's Google account on Quorla's Connections page. The team prepares posts in Quorla; an admin reviews and
|
|
> approves the exact post, and Quorla publishes it at the scheduled time. Nothing is posted without that approval.
|
|
> Tokens are encrypted at rest and deleted when the account is disconnected.
|
|
|
|
**Quorla project, scope justifications:**
|
|
- `youtube.upload`: Upload the video an agency admin approved in Quorla to the connected channel, with the title,
|
|
description, visibility and "made for kids" setting chosen on the post screen. Only approved posts are uploaded.
|
|
- `youtube.readonly`: Show which channel is connected (name, handle, avatar, subscriber count) on the Connections
|
|
page, so the agency posts to the right channel, and link to the uploaded video afterwards.
|
|
|
|
**GMB Audit project, scope justification:**
|
|
- `business.manage`: List the business locations the connected account manages so the admin can pick the client's
|
|
location, and publish approved "updates" (local posts with text, photo and an optional button) to that location.
|
|
|
|
**Demo video** (one recording, uploaded to YouTube as Unlisted; link it in both forms). Use English and show the
|
|
browser's address bar so the project's OAuth client ID is visible in the consent URL:
|
|
1. quorlasocial.com homepage → privacy policy link → Sign in at app.quorlasocial.com.
|
|
2. Connections → pick a client → YouTube → Connect → Google account chooser → consent screen showing **Quorla** and
|
|
the YouTube scopes → Allow → back in Quorla, channel shown as connected.
|
|
3. Publishing → New post → upload a vertical video → caption → tick YouTube → title, visibility → Save as draft →
|
|
Approve → post publishes → open the video on YouTube.
|
|
4. Connections → Google Business Profile → Connect → consent screen (business.manage) → choose the location.
|
|
5. New post with a photo → tick Google Business Profile → button "Learn more" → Approve → open the update on Google.
|
|
6. Connections → Disconnect, to show tokens can be removed.
|