Uploading to YouTube by API: the audit that locks your videos private

An automatic YouTube uploader works only if the API project has passed YouTube's compliance audit first. Videos uploaded by an unverified YouTube Data API project are locked to private, and YouTube does not allow an appeal. Daily upload quota is the second limit, and the same audit raises it.

Plan for the audit before writing upload code, because the review takes time that cannot be compressed. Most guides mention these two facts only after the pipeline is built.

What we'll cover

• The private lock, and why it cannot be appealed
• The quota arithmetic
• What the audit involves
• Credentials: OAuth, not an API key
• Building it with CodeWords
• Uploading a large file properly
• Metadata, and where the limits are
• What the API will not do
• Failure modes worth handling
• Making it survive
• Limits worth knowing about
• What to check first
• Frequently asked questions

Key takeaways

• Uploads from a YouTube API project that has not passed the compliance audit are locked to private, and the lock cannot be appealed.
• Check the project's audit status before uploading any real content, because the only remedy is manual re-upload.
• An API key cannot upload; the pipeline needs OAuth 2.0 with the upload scope.
• Move the OAuth consent screen out of Testing status, or refresh tokens expire after seven days.
• Use resumable uploads and record the video ID the moment an upload completes.

The private lock, and why it cannot be appealed

Videos uploaded through videos.insert by an API project that has not passed a compliance audit are restricted to private, and for projects created since 28 July 2020 this is the default state.

The part that hurts: you cannot appeal a video locked this way. The remedy is to re-upload it through a verified project or through the YouTube app or website (YouTube's quota and compliance audits guide, videos locked as private).

The order of work matters. If you build the pipeline, upload a month of content and only then discover the lock, you must re-upload that month by hand. Check your project's status before the first real upload and the problem does not arise.

Test with content you do not mind re-doing until you have confirmed a video goes out at the privacy status you asked for.

The quota arithmetic

Upload volume is limited by quota, which works differently from a simple rate limit. A project that enables the YouTube Data API gets a default allocation of 10,000 units per day (YouTube Data API quota page, 2026), and each operation costs a different number of units. Older guides put the practical ceiling at about six uploads a day, because an upload once cost 1,600 units. Google's YouTube Data API overview (2026) now lists videos.insert with its own limit of 100 calls per day, so check the current page and your project's quota in the Google Cloud console before designing the schedule.

Three consequences follow.

Count your units before designing the schedule, rather than assuming you can upload as often as you like.

Reads are cheap and searches are expensive. A pipeline that searches before every upload spends its quota on the search.

Quota resets daily, on Pacific time. Knowing this explains a run that fails at an apparently arbitrary hour.

Raising the allocation requires the same audit as lifting the private lock, so do the audit once, early.

What the audit involves

The audit is a review of whether your use complies with the API Services Terms, submitted through YouTube's audit and quota extension form.

Expect to describe what your project does, who uses it, and how. A project that uploads a creator's own content to their own channel is a straightforward case. A project uploading on behalf of many unrelated users, or republishing content that is not yours, is a harder case and attracts questions.

Two practical points. Submit early, because the review takes time and gates both the private lock and any quota increase. Describe the actual use rather than an aspirational one, because a mismatch between what you said and what the project does causes trouble later.

Credentials: OAuth, not an API key

An API key cannot upload videos. A key identifies a project and authorises nothing on a user's behalf, so it can read public data only.

Uploading requires OAuth 2.0 with the appropriate upload scope, and the account that authorises must own or manage the channel being uploaded to. If the channel is a brand account, the authorising Google account needs the right permissions on it, which is a separate thing from owning the login.

One trap carries over from Google OAuth generally. While the consent screen is in Testing status, refresh tokens expire after seven days, so an upload pipeline that works all week will fail the next one. Move the project to production before relying on it. The general picture is in which Google credential you need.

Building it with CodeWords

CodeWords connects to 3,000+ integrations (CodeWords integrations directory, 2026), and each connection is made once and reused.

1. Open CodeWords and start a new automation.
2. Describe what should happen in plain language to Cody, the automation builder: where the video comes from, what metadata it should carry, and whether it publishes or stays private for review.
3. Authorize the connections to your storage, your YouTube account and anywhere you want to be notified.
4. Describe the exceptions: an upload that fails partway, a quota exhaustion, a file that is not what was expected.
5. Default new uploads to private and publish deliberately, so a pipeline problem produces an unlisted video rather than a public mistake.

You describe the outcome; Cody builds it, connects it, and deploys it. The Free plan covers light use. Pro costs $39 per month and Business costs $100 per month as usage grows (CodeWords pricing page, 2026); details are on the pricing page.

Uploading a large file properly

Use a resumable upload for large video files, not a single request. A resumable upload survives an interruption, continues instead of restarting, and reports progress. A two-gigabyte upload that fails at ninety per cent and starts again is how an afternoon disappears.

Related details worth getting right: set the content type correctly, do not hold the whole file in memory, and treat the upload as a long operation rather than something to run inside a short-lived request.

Check what came back. A successful call returns a video id, and that id is what you need for the thumbnail, the playlist and any later update. Losing it means finding the video by title, which is unreliable.

Metadata, and where the limits are

Metadata limits are firm, and the upload carries the metadata with it. The title allows up to 100 characters and the description up to 5,000 (YouTube Data API documentation, 2026). Tags count against a combined character budget rather than a simple count. Category is an id rather than a name. Privacy status is one of private, unlisted or public, and a scheduled publish time only applies to videos that are private.

Thumbnails are a separate call after the upload, and custom thumbnails require the channel to be verified. That is a channel-level requirement rather than an API one, and it is the most common reason a thumbnail call fails on an otherwise working pipeline.

Truncate deliberately rather than letting the API reject the request. A description generated without a length check will eventually exceed 5,000 characters and fail the whole upload.

What the API will not do

The API cannot do everything the YouTube interface does. It does not set some monetisation properties, which remain in Studio. It does not perform many Shorts-specific operations. It does not return all the analytics available in the interface, which come from a different API. It does not allow bulk edits as freely as the web interface.

Anything the API cannot do is a manual step. A pipeline that is 90 per cent automated with a manual step in the middle needs that step to be visible, not assumed.

Failure modes worth handling

Quota exhausted. Stop cleanly, say so, and resume after the reset rather than retrying into a wall.

Token expired or revoked. Detect and alert. Silent failure means discovering a gap in the schedule weeks later.

Upload interrupted. Resume rather than restart.

Video locked private. Check the project status; this is the audit.

Thumbnail rejected. The cause is usually missing channel verification, and sometimes the file size limit.

Duplicate upload. A retry that succeeded the first time. Record the video id at the moment the upload completes, before any later step can fail.

Making it survive

Confirm audit status before the first real upload.

Budget the quota and alert before it is exhausted rather than after.

Keep the project in production status, not Testing.

Record the video id immediately on success.

Default to private and publish deliberately.

Limits worth knowing about

Unverified projects upload to private, with no appeal, and re-uploading is the only remedy.

Default quota limits upload volume, so check the current limit before planning a bulk pipeline.

An API key cannot upload. OAuth with the upload scope is required.

Custom thumbnails need a verified channel, independent of the API.

Some operations are not available through the API at all, and remain manual.

What to check first

Check whether your API project has passed the compliance audit. Make this check before writing any upload code. It decides whether the pipeline produces publishable videos or a folder of private ones you cannot appeal. Everything else here is ordinary engineering.

Two habits make the difference. Submit the audit early, because it gates both the private lock and any quota increase. Record the video ID the moment an upload completes, because every later step needs it and finding a video by title afterwards is unreliable.

Frequently asked questions

Why are my API-uploaded videos private?

The API project has not passed a compliance audit. YouTube restricts uploads from unverified projects to private, and for projects created since 28 July 2020 that is the default. Passing the audit lifts the restriction for new uploads, but videos already locked stay private.

Can I appeal a video locked as private?

No, YouTube does not allow an appeal. The remedy is to re-upload the video through a verified project or through the YouTube app or website. Check your project status before uploading anything real, so no content needs re-uploading.

How many videos can I upload per day?

The default YouTube Data API allocation allows 100 videos.insert calls a day, separate from the 10,000 daily units for other calls (Google YouTube Data API overview, 2026). Older guides cite about six uploads a day from the earlier unit cost. Check the Google Cloud console for your project's figure. Raising it requires the same audit that lifts the private lock.

Can I upload with an API key?

No, an API key cannot upload. A key authorises nothing on a user's behalf. Uploading requires OAuth 2.0 with the upload scope, authorised by a Google account that owns or manages the target channel, including brand account channels.

Why did my pipeline stop working after a week?

The most likely cause is that the OAuth consent screen is still in Testing status, where refresh tokens expire after seven days. Move the project to production status before relying on the pipeline, then re-authorise the connection so a new token is issued.

What does the audit involve?

The audit is a review of whether your use complies with the API Services Terms, submitted through YouTube's audit and quota extension form. Describe what the project does, who uses it and how. Describe the actual use rather than an aspirational one.

How should large files be uploaded?

Use a resumable upload, so an interruption continues instead of restarting a multi-gigabyte transfer. Treat the upload as a long operation, not something inside a short request, set the content type correctly, and avoid holding the whole file in memory.

What are the metadata limits?

The title allows 100 characters and the description 5,000. Tags count against a combined character budget, category is an ID, and scheduled publishing applies only to private videos. Truncate text deliberately in the automation, because an over-length description makes the whole upload request fail.

Why is my thumbnail upload failing?

The usual cause is that custom thumbnails require a verified channel. This is a channel-level requirement independent of the API, so verify the channel in YouTube Studio before retrying the thumbnail call.

What cannot be done through the API?

The API cannot set some monetisation settings, perform many Shorts-specific operations, or return the full analytics available in the interface. These remain manual steps. Make each manual step visible in the process rather than assumed, so the pipeline does not stall silently.

Related reading

• Which Google credential you need
• Where AI actually helps a channel
• Managing credentials across automations