Use existing gcloud auth
If you already run gcloud on this machine, the desktop app can use its Application Default Credentials instead of a separate Google sign-in. Nothing is copied, no token is stored by Querylab.io, and revoking in gcloud revokes in the app. Use it when you want one Google login for the terminal and the IDE, or when a browser sign-in isn't an option.
# Install the Google Cloud CLI if you don't have it
brew install --cask google-cloud-sdk
# Create Application Default Credentials (opens a browser)
gcloud auth application-default loginThen, in the app, click Continue with local gcloud on the first screen. The step-by-step with the cards is on Connecting to BigQuery; this page is for when that doesn’t work.
What the app needs
gcloudinstalled and on yourPATHgcloud auth application-default logincompleted at least once- The ADC account can see at least one project with BigQuery enabled
The app asks gcloud for a token; nothing is copied and nothing is sent to Querylab.io. Because gcloud is the source of truth, gcloud auth application-default revoke or a re-login with another account takes effect at the next token refresh (the next launch, or the first request after the current token expires), or immediately if you sign out and back in.
If the app can’t find gcloud, launch it from a terminal where gcloud resolves (open -a Querylab).
Which scopes the token has
ADC has whatever scopes you granted at login; Querylab.io can’t ask for more. The default login grants cloud-platform, which covers BigQuery and project listing. Which features need which scopes, and the login command for Google Sheets export, are on Authentication.
Which project gets billed
BigQuery jobs are billed to the project you run them in (the Run on project in the tab’s status-bar popover), not to gcloud’s quota project. You can ignore gcloud auth application-default set-quota-project and the “quota project” warning gcloud prints at login.
Your gcloud project
gcloud’s active project is used for one thing: pre-filling the Missing a project? field in Settings → BigQuery when you have no projects configured yet and that project isn’t in the list Google returned. Which projects appear in the tree, and which one a tab runs on, are set in Querylab.io, exactly as with Google sign-in; gcloud config set project afterwards changes nothing in the app.
When ADC and Google sign-in disagree
ADC and Google sign-in can coexist: if a Google sign-in already exists in the app and ADC is used on top of it, both must be the same Google account. If not:
Run that command and try again. There is no check when ADC is your only sign-in: the ADC account is your account.
Troubleshooting
The card on the first screen shows one of these lines:
| Card says | Fix |
|---|---|
| Google Cloud SDK (gcloud) is not installed on this device. | Install it, or launch the app from a terminal where gcloud resolves |
| No local gcloud credentials found on this device. | gcloud auth application-default login |
| Local gcloud credentials were revoked or expired. | Run the login again |
| Your gcloud session needs to be re-authenticated. | Run the login again |
| Could not reach Google to validate gcloud credentials. Check your network connection. | Fix the connection, then click the re-check arrow on the card |
| gcloud is taking too long to respond. Check your network connection or sign in manually. | Check the network; or sign in with Google instead |
| Local gcloud sign-in is not available. | Run gcloud auth application-default print-access-token in a terminal and read its error |
After fixing, click the re-check arrow on the card. No restart is needed. The card shows the short version of gcloud’s error; for the full text, run the same command in a terminal:
# Check what the app will see
gcloud auth application-default print-access-token | cut -c1-12
gcloud config get-value project
gcloud config get-value account
# Start over with a specific account
gcloud auth application-default revoke
gcloud auth application-default login [email protected]