Proving a bulk update worked without ever asking for the password

Retitling, re-tagging, and commenting across a whole playlist by hand in YouTube Studio has no audit trail, and it usually means the channel owner either does it themselves or gives someone else their login to do it for them. Neither is good: the first doesn't scale past a handful of videos, and the second means handing over full control of the channel just to change some titles.

The fix is OAuth, not a password and not a headless browser pretending to be the owner. The owner clicks through Google's own consent screen once, a token comes back scoped to what the app asked for, and the person running the scripts never sees or needs a login at all.

The YouTube Data API's video-update call takes the entire metadata snippet, not a per-field patch. Send only the new title, description, and tags, and the API happily wipes the category, default language, and default audio language along with it, with no error and no warning.

The fix has to run before the first write, not after: a snapshot script reads and saves every field that matters, including the three nobody meant to touch, so the update script can carry them forward on every single request. Skipping that one step is how a simple retitle quietly breaks a video's language metadata.

A run against dozens of videos can die at any point: a rate limit, a dropped connection, a closed laptop lid. Every script that writes reads its own log first, builds the set of videos it already finished, and skips them, so the same command is always safe to run again from wherever it stopped.

That same design has one sharp edge, disclosed rather than hidden: a title update builds the new title from whatever the video's live title already is, not from an original stored anywhere. If the log gets corrupted mid-run and a video gets reprocessed, the suffix gets appended a second time, and a third on the next bad re-run. The fix isn't clever code, it's telling the person running it to check the log file is intact before trusting a re-run.

A verification step exists specifically for the case where the person running the update doesn't have, and shouldn't need, Studio access to the channel being changed. It re-fetches every video's current state straight from the API and prints a report, rather than reading back whatever the update script logged about itself.

That distinction matters more than it sounds: a log only proves a script believed it succeeded. A fresh read from the same source YouTube itself serves is the only way to hand a channel owner proof of what actually changed, without asking them to go look for themselves.

Six scripts cover the whole arc: one-time OAuth authorization, a pre-write snapshot, the bulk title and description and tag update, a paced comment post across every video, a live-state verification report, and a snapshot-based revert. Comment pacing in particular is a deliberate 8 to 15 second randomized delay between posts, sized from what actually trips YouTube's spam filter, not a guess.