> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asktable.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting Google BigQuery

> Create a Service Account key in Google Cloud and connect a BigQuery data source in AskTable.

AskTable connects to Google BigQuery with a Service Account key. There are two steps: create a service account with read-only permissions in Google Cloud and download its JSON key, then paste the key into AskTable.

## 1. Create a Service Account key

<Steps>
  <Step title="Open the service accounts page">
    Open the [Google Cloud Console](https://console.cloud.google.com), select the target project at the top, go to **IAM & Admin → Service Accounts**, click **Create Service Account**, and give it a name (for example, `asktable-readonly`).
  </Step>

  <Step title="Grant BigQuery permissions">
    Grant the service account the following two roles — the minimum required for AskTable's read-only queries:

    | Role                                                   | Purpose                      |
    | ------------------------------------------------------ | ---------------------------- |
    | **BigQuery Data Viewer** (`roles/bigquery.dataViewer`) | Read table data and metadata |
    | **BigQuery Job User** (`roles/bigquery.jobUser`)       | Submit query jobs            |

    To expose only specific datasets, skip the project-level Data Viewer role: in the BigQuery console, click **Share → Add Principal** on the target dataset and grant Data Viewer to the service account there. Job User still needs to be granted at the project level.
  </Step>

  <Step title="Create a JSON key">
    Open the service account you just created, switch to the **Keys** tab, click **Add Key → Create new key**, and choose **JSON**. Your browser downloads a `.json` key file — this file is the only credential you need for the next step.
  </Step>
</Steps>

<Note>
  Two situations prevent key creation: BigQuery sandbox projects (without billing enabled) do not support service account keys, and some organization policies (`iam.disableServiceAccountKeyCreation`) disable key creation — contact your Google Cloud administrator if you hit an error.
</Note>

## 2. Connect in AskTable

In the left main navigation, click **More**, then click **Data Sources** in the data workspace sidebar and click **Add Data** in the top right. Under the **Big Data** category, select **Google BigQuery** and fill in the connection details:

| Field                    | Description                                                                                                                              |
| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Data name**            | Optional. Leave blank to auto-generate.                                                                                                  |
| **Service Account JSON** | Paste the full content of the key file, or click **Upload JSON file** to select the downloaded `.json` file and fill it in automatically |

There is no host, port, or project ID to fill in — AskTable detects the GCP project from the key automatically.

Click **Add Now**. AskTable tests the connection automatically. On success, you proceed to table selection — BigQuery datasets appear as the schema level there.

<Note>
  The key is stored encrypted in AskTable and is never echoed back by any page or API. To rotate the key later, paste a new one in the connection settings on the data source detail page; leaving it blank keeps the current key unchanged.
</Note>

## Troubleshooting

| Symptom                                            | Cause and fix                                                                                                                                 |
| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| Invalid credential format                          | The pasted content is not complete JSON, or is missing the `project_id` / `client_email` / `private_key` fields. Re-copy the entire key file. |
| Connection test fails with an authentication error | The key has been revoked or deleted. Create a new key in Google Cloud.                                                                        |
| Connection test fails with a permission error      | The service account is missing the **BigQuery Job User** role and cannot submit queries.                                                      |
| A dataset is missing on the table selection page   | The service account lacks **BigQuery Data Viewer** on that dataset — grant it as described in step 1.                                         |

## Next steps

* [Managing Data](/en/concepts/data/manage) — view and manage connected data sources
* [Table and Field Notes](/en/concepts/data/annotations) — add business descriptions to improve AI accuracy