# Use existing gcloud auth

> If you already run gcloud on this machine, the desktop app can use its Application Default Credentials instead of a separate Google sign-in. Nothing is copied, no token is stored by Querylab.io, and revoking in gcloud revokes in the app. Use it when you want one Google login for the terminal and the IDE, or when a browser sign-in isn't an option.

Source: https://docs.querylab.io/desktop-app/gcloud-auth/

```bash
# Install the Google Cloud CLI if you don't have it
brew install --cask google-cloud-sdk

# Create Application Default Credentials (opens a browser)
gcloud auth application-default login
```

Then, in the app, click **Continue with local gcloud** on the first screen. The step-by-step with the cards is on [Connecting to BigQuery](https://docs.querylab.io/getting-started/connecting-to-bigquery/#local-gcloud-adc); this page is for when that doesn't work.

## What the app needs

- `gcloud` installed and on your `PATH`
  - `gcloud auth application-default login` completed at least once
  - The ADC account can see at least one project with BigQuery enabled

The app asks gcloud for a token; nothing is copied and nothing is sent to Querylab.io. Because gcloud is the source of truth, `gcloud auth application-default revoke` or a re-login with another account takes effect at the next token refresh (the next launch, or the first request after the current token expires), or immediately if you sign out and back in.

If the app can't find gcloud, launch it from a terminal where `gcloud` resolves (`open -a Querylab`).

## Which scopes the token has

ADC has whatever scopes you granted at login; Querylab.io can't ask for more. The default login grants `cloud-platform`, which covers BigQuery and project listing. Which features need which scopes, and the login command for Google Sheets export, are on [Authentication](https://docs.querylab.io/getting-started/authentication/#adc-scopes).

## Which project gets billed

BigQuery jobs are billed to the project you run them in (the **Run on** project in the tab's status-bar popover), not to gcloud's quota project. You can ignore `gcloud auth application-default set-quota-project` and the "quota project" warning gcloud prints at login.

## Your gcloud project

gcloud's active project is used for one thing: pre-filling the **Missing a project?** field in Settings → BigQuery when you have no projects configured yet and that project isn't in the list Google returned. Which projects appear in the tree, and which one a tab runs on, are set in Querylab.io, exactly as with Google sign-in; `gcloud config set project` afterwards changes nothing in the app.

## When ADC and Google sign-in disagree

ADC and Google sign-in can coexist: if a Google sign-in already exists in the app and ADC is used on top of it, both must be the same Google account. If not:

> ADC is logged in as `alex@personal.example`, but you're signed into   Querylab.io as `alex@ace-analytics.example`. Please run: `gcloud auth   application-default login --account=alex@ace-analytics.example`

Run that command and try again. There is no check when ADC is your only sign-in: the ADC account is your account.

## Troubleshooting

The card on the first screen shows one of these lines:

| Card says                                                                                | Fix                                                                                       |
| ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
| Google Cloud SDK (gcloud) is not installed on this device.                               | Install it, or launch the app from a terminal where `gcloud` resolves                     |
| No local gcloud credentials found on this device.                                        | `gcloud auth application-default login`                                                   |
| Local gcloud credentials were revoked or expired.                                        | Run the login again                                                                       |
| Your gcloud session needs to be re-authenticated.                                        | Run the login again                                                                       |
| Could not reach Google to validate gcloud credentials. Check your network connection.    | Fix the connection, then click the re-check arrow on the card                             |
| gcloud is taking too long to respond. Check your network connection or sign in manually. | Check the network; or sign in with Google instead                                         |
| Local gcloud sign-in is not available.                                                   | Run `gcloud auth application-default print-access-token` in a terminal and read its error |

After fixing, click the re-check arrow on the card. No restart is needed. The card shows the short version of gcloud's error; for the full text, run the same command in a terminal:

```bash
# Check what the app will see
gcloud auth application-default print-access-token | cut -c1-12
gcloud config get-value project
gcloud config get-value account

# Start over with a specific account
gcloud auth application-default revoke
gcloud auth application-default login --account=you@example.com
```