Refresh and Rotate YouTube OAuth2 Access Tokens

Google access tokens expire after roughly an hour, and every YouTube reporting flow that carries a hardcoded token is a countdown to a 401. This blueprint makes rotation a first-class flow: io.kestra.plugin.youtube.OAuth2 exchanges the long-lived refresh token for a fresh access token, the token lands in the namespace KV store where every other YouTube flow can read it, and Slack receives the expiry metadata so the team knows the credential chain is healthy.

How it works

1. refresh_access_token (io.kestra.plugin.youtube.OAuth2) posts the client ID, client secret, and refresh token to Google's token endpoint and outputs accessToken, expiresAt, expiresIn, scope, and tokenType.
2. store_token writes the fresh token into the namespace KV store under YOUTUBE_ACCESS_TOKEN. Downstream flows read it with {{ kv('YOUTUBE_ACCESS_TOKEN') }} and always see the latest value.
3. notify posts the token type, lifetime, expiry timestamp, and granted scope to Slack. The access token itself is never interpolated into the message.
4. The errors block raises a distinct Slack alert when the exchange fails, which usually means the refresh token was revoked or the client credentials were rotated.
5. A disabled-by-default Schedule trigger runs the flow on the first of every month as a credential health check; run it more often, or call it as a subflow, when downstream flows need a token that is always live.

What you get

• A repeatable rotation path instead of a manual OAuth playground session every time a token dies.
• The fresh token published to one well-known KV key that every YouTube flow shares.
• Expiry metadata in Slack, so token health is visible without opening Kestra.
• An immediate alert when the refresh token itself stops working, the failure mode that otherwise surfaces as confusing 401s across unrelated flows.

Who it's for

• Content analytics teams running several YouTube flows off one Google Cloud project.
• Platform engineers who want credential rotation observable and auditable like any other job.
• Anyone tired of pasting fresh tokens into flow definitions by hand.

Why orchestrate this with Kestra

Token refresh is a small HTTP call with large blast radius when it stops working. Kestra gives the call a schedule, an execution history that shows exactly when each rotation happened, a KV store to hand the result to other flows, and an alert path for the day Google revokes the grant. The rotation becomes infrastructure instead of tribal knowledge.

Prerequisites

• A Google Cloud project with the YouTube Data API v3 enabled and an OAuth2 client (client ID and secret).
• A refresh token from the initial authorization flow with YouTube read scope.
• A Slack incoming webhook for confirmations and failure alerts.

Secrets

• YOUTUBE_CLIENT_ID: OAuth2 client ID from the Google Cloud console.
• YOUTUBE_CLIENT_SECRET: OAuth2 client secret from the Google Cloud console.
• YOUTUBE_REFRESH_TOKEN: refresh token obtained during the initial authorization flow.
• SLACK_WEBHOOK_URL: Slack incoming webhook URL.

Quick start

1. Add the four secrets to your Kestra namespace.
2. Execute the flow and confirm the Slack message shows a valid expiry and the expected scope.
3. Point your other YouTube flows at {{ kv('YOUTUBE_ACCESS_TOKEN') }}.
4. Set disabled: false on the monthly trigger.

How to extend

• Call this flow as a subflow at the start of longer YouTube pipelines so each run begins with a live token.
• Tighten the schedule to hourly if downstream flows read the KV value directly instead of refreshing themselves.
• Add an If task on expiresIn to alert when Google starts returning unusually short lifetimes.
• Reuse the same pattern for any Google API by adjusting the scopes granted during the initial authorization.

Links

• YouTube plugin documentation
• Google OAuth2 documentation