BigQuery Authentication

Qualytics authenticates to BigQuery with a Google Cloud service account. The connection form takes a single credential: the Service Account Key, a JSON file you upload when creating the connection.

Service Account Key

The key file already contains everything BigQuery needs to identify the caller, including the service account's email and its private key, so you do not enter those separately. Qualytics treats the file as a secret: once saved, it is never displayed back.

To create one:

1. In the Google Cloud console, open IAM & Admin > Service Accounts and select (or create) the service account Qualytics will use.
2. Grant it the BigQuery roles listed on the Permissions page.
3. On the Keys tab, click Add key > Create new key, choose JSON, and click Create. The file downloads once and cannot be downloaded again later, so store it safely.
4. Upload the downloaded file in the Service Account Key field of the connection form.

See Google's service account key documentation for details on creating and deleting keys, and the Project ID reference for locating the project the account belongs to.

Key Lifecycle

Service account keys do not expire, but project administrators can delete or disable them at any time. If a working connection starts failing authentication, verify the key's status in IAM & Admin > Service Accounts > Keys and, if needed, create a new key and update the connection through the Manage Connections page.

Secrets Management

Instead of uploading credentials directly, you can retrieve them from HashiCorp Vault: configure the Secrets Management group on the connection form and reference a key from the configured Vault secret with ${key} in any connection property. The Vault fields are described in the Add Source Datastore field reference.