Permissions we request
yellit asks for the narrowest set of permissions that lets it publish. Two scopes per platform at most: one to read the name of the account you connected, so you can see where a post is going, and one to publish. None of them grant read access to your existing content.
| Platform | Permission | Why |
|---|---|---|
instagram_business_basic | Show which account is connected. | |
instagram_business_content_publish | Publish the images, carousels, and Reels you ask it to. | |
| YouTube | youtube.upload | Upload the videos and Shorts you ask it to. |
| YouTube | youtube.readonly | Read your channel's name once, when you connect it, to show which channel a post will go to. |
| X | Read and write | Post on your behalf. X offers no write-only scope. |
| TikTok | user.info.basic | Read your display name once, when you connect, to show which account is connected. |
| TikTok | video.publish | Publish the video you ask it to, at the visibility you chose. |
Why a read permission at all
Because you can connect several accounts across four platforms, and without a name they are indistinguishable rows on a page. Reading the display name or channel title once, at the moment you connect, is what lets the accounts page tell you which account you linked — and lets you catch it before you publish to the wrong one.
On YouTube it does one more thing worth having: a Google account with no channel behind it is refused at connect time, with an explanation, instead of accepting the connection and failing on your first upload.
In both cases the permission is used for exactly one call, at connect time, and never again.
What we deliberately do not request
- TikTok's
video.upload. It can only drop a draft into your inbox for you to finish by hand in the TikTok app. yellit exists to publish to several platforms in one action, and a path ending in "now go finish this somewhere else" would not do that. - YouTube's
force-ssland broadyoutubescopes. Both grant read and write across your whole channel. Uploading a video does not need either. - Anything that reads your audience. No insights, no analytics, no follower lists, no comments, no direct messages. yellit has no feature that would use them.
Taking a permission back
Disconnect an account from your accounts page and the stored tokens for it are deleted immediately. You can also revoke yellit from the platform's own settings — Google keeps its list under third-party access, and Instagram, X and TikTok each keep one under their apps or security settings.
Either way there is nothing left to publish with. See deleting your data for removing the account itself.