YouTube Developer Policies require apps using the embedded player to identify themselves with a Referer

Announced7 Jul 2025

Effective7 Jul 2025

StatusIn effect

What changed

On July 7, 2025 YouTube added an API Client Identity and Credentials section to the embedded player part of the Required Minimum Functionality, and consolidated similar guidance from Complying with YouTube's Developer Policies. API clients that use the embedded player, including the IFrame Player API, must provide identification through the HTTP Referer request header. In browsers this usually happens automatically, and YouTube recommends the strict-origin-when-cross-origin Referrer-Policy. In WebView integrations, where Referer is empty by default, the app must set it, for example through baseUrl or an added Referer header.

What it means

Apps that show YouTube videos in an embedded player, including previews inside scheduling tools and mobile or desktop apps, must send an HTTP Referer that identifies the API client.

Who is affected

Scheduling and social tools that preview YouTube videos with the embedded player or IFrame Player API, especially in mobile WebViews and desktop apps.

What to do by 7 Jul 2025

Check that embedded players send a Referer: avoid Referrer-Policy values or window.open noreferrer that suppress it, and set it yourself in WebViews.

What this means for you

When an app plays a YouTube video inside itself, YouTube wants to know which app is asking, a bit like signing a visitor book at the door. Web browsers usually do this on their own. Phone and desktop apps sometimes leave the book blank, and YouTube's rules now say they must fill it in.

The details

Where: Required Minimum Functionality, YouTube embedded player section, "API Client Identity and Credentials" (added July 7, 2025).
Rule: "API Clients that use the YouTube embedded player (including the YouTube IFrame Player API) must provide identification through the HTTP Referer request header."
Browsers: do not set a Referrer-Policy that suppresses Referer; YouTube recommends strict-origin-when-cross-origin. Do not use the noreferrer feature with window.open for a window that hosts the player.
WebViews: Referer is empty by default, so set it: with a local HTML file, use baseUrl (Android loadDataWithBaseURL, iOS loadHTMLString:baseURL:); without one, add a Referer header to the request (Android loadUrl with additionalHttpHeaders, iOS loadRequest:); in Android Custom Tabs, use Intent.EXTRA_REFERRER with the android-app:// scheme.
Not stated: an enforcement date, or what happens to players that send no Referer.

What to do next

Business owners: Nothing.
Marketers and agencies: Nothing.
Developers: Audit every place your app embeds the YouTube player and make sure a Referer identifying your app is sent, especially in WebViews.

Follow new entries with the RSS feed. Each platform also has its own feed, for example X or Meta.