Administration

This page is for platform admins: the Klyo operators who work across Organizations to onboard clients, watch for failures, and check what is deployed. A platform admin is a Klyo-level role, separate from your role inside any one Organization.

What works today

Onboarding (declaring a client's project, probing it, enabling APIs, creating the bucket, storing the Creatomate key), the cross-org organizations and users consoles, the monitoring and failure console, and the system version page are all wired. One thing it does not do is create Google Cloud projects for clients; see the note in onboarding.

Onboarding an Organization

Onboarding connects an Organization to the Google Cloud project that will run its generation and hold its assets. The flow lives in the admin organizations console, where you pick an Organization and open its setup panel.

1. Declare the data plane: the client's Google Cloud project, region, and assets bucket.
2. Probe it. Klyo checks the project against a checklist of requirements and reports each as pass, fail, blocked, or not-yet-checked.
3. Fix the gaps: enable a missing API on the project, or create the assets bucket, straight from the checklist.
4. Add the Creatomate render key, stored as a Secret Manager reference. Klyo keeps the reference, never the secret value itself.

Klyo reaches the client project through a single shared service account that the client grants roles to. The setup panel shows that service account and the roles to grant.

The setup checklist

The checklist has required and optional items. The required ones decide whether the Organization is ready:

• Required: Klyo can reach the project, the Cloud Storage API is on, the assets bucket exists, the per-Organization task queues are provisioned, and the Creatomate render key is configured.
• Optional: Vertex AI (for generation), billing linked, Display & Video 360, and Google Ads.

An Organization moves from draft to ready when the required checks pass, and flips to error if a ready Organization later regresses, for example if a role grant is revoked. That state change is recorded as an Action, so a regression shows up in the activity and failure views.

Klyo does not create projects

Onboarding probes and configures a project that already exists. Klyo does not create the Google Cloud project for the client. The "provisioning" state exists in the model but is not used, because project creation is not part of the app.

Channel connections

Before a campaign can activate, someone connects the ad channels it will publish to. A connection is one authorized account (a YouTube channel, a Google Ads account, or a DV360 advertiser) that Klyo can act through. Any member can see the connection list read-only (its health, accounts, and last check) on the Organization page's Connections tab, since the list holds no secret. Creating, re-checking, and disconnecting stay Organization admin (or platform admin) actions. On the Template step, every activation target still shows: one whose connection is missing is locked with a "Connect X to unlock" pointer, not hidden.

Each provider connects its own way:

• YouTube and DV360: sign in with a Google account. Klyo opens Google's consent screen, and after you approve it keeps only a reference to the refresh token (in Secret Manager), never the token itself. YouTube then lets you pick which of the account's channels to use.
• Google Ads: two ways. Sign in with a Google account (the same handshake, then pick which Ads account to use), or link an account under Klyo's manager account. Linking has a prerequisite: the account must first accept the manager link invitation from Klyo's manager account, whose customer id the connect dialog shows. A manager (MCC) account is listed but not selectable, since it only manages others and cannot run a campaign.

When you reach connections from an activation surface (the queue's health strip or a connect link), finishing the sign-in returns you to the step or queue you left.

A DV360 connection also authenticates the nightly Reporting pull: a Tracked Campaign reads through the same connection, so keeping it healthy keeps its KPIs flowing.

Klyo re-checks each connection's health and shows it (connected, needs attention, or reconnect); a connection that goes bad notifies the Organization's admins. Health does not wait for a manual re-check: the auto-activation drain, a failed push, and the metrics pull each record what they find and ring the same admin alert. A validation also catches a partial consent, a permission left unticked on Google's consent screen, and flags the connection with the missing permission named instead of passing as connected and failing later. Before you disconnect one, Klyo shows how many activations still reference it.

Google Ads needs a developer token

Live Google Ads calls, including listing accounts, need Klyo's Google Ads developer token to be configured. Until it is, a signed-in Google Ads connection reads "not configured".

Cross-org consoles

Platform admins get views that span every Organization:

• Organizations: list every Organization, see who created it, create new ones, and open one to onboard it.
• Users: a directory of every user, filterable, with the ability to suspend and restore.
• Monitoring: cross-org Actions and generation jobs, with stat cards and filters, and the failure console for acknowledging failures. Opening an Action here also shows the actual provider request behind a generation or render (the prompt, model, resolution, and reference assets sent to Google or Creatomate), a platform-admin-only view that regular Organization members do not see. An LLM usage tab audits every assistant turn: who asked, the question, which tools ran, token counts, and failures. See Activity and failures.

System

The system page reports the basics of what is running: the service name, its version, and the deployment environment (dev, staging, or prod), with a plain note on what each environment means.

What you can do today

• Onboard an Organization: declare its project, probe it, enable APIs, create the bucket, and store its Creatomate key.
• Read the live setup checklist and the Organization's readiness state.
• Manage Organizations and users across the whole platform.
• Watch cross-org activity and acknowledge failures.
• Connect the ad channels (YouTube, Google Ads, DV360) on the Organization settings page, and watch each connection's health.
• Inspect the provider request behind a generation or render Action.
• Check the running version and environment.