# Authentication

> Querylab.io has no password of its own. It signs you in with Google, asks for the BigQuery scope, and asks for further scopes only when a feature needs them. On the desktop the token stays on your machine; on the web it is stored on Querylab.io servers so your session can be refreshed without signing in again.

Source: https://docs.querylab.io/getting-started/authentication/

**app.querylab.io**

<p>
      <b>Connect your data</b>
      <br />
      Sign in with Google to query your own BigQuery projects. Data flows
      directly between your browser and Google. Querylab.io never stores or
      processes it.
    </p>
    <p>
      <b>Playground</b>
      <br />
      Explore Querylab.io without connecting your data. BigQuery access not
      needed.
    </p>
    <p>☐ I agree to the Terms of Service and Privacy Policy</p>

The web sign-in page. Two cards, Connect your data and Playground, and one checkbox that both require.

## Web app

Tick the agreement checkbox and click **Continue with Google**. The first Google prompt asks only for your email and profile, which identify you to Querylab.io. The BigQuery permission comes on the next step, **Grant BigQuery access**, when you click **Grant Access**. After that you pick your projects and you're in.

## Desktop app

The desktop app starts with **Step 1 of 2 · Authentication** and two cards:

- **Local gcloud (ADC)**, with the button **Continue with local gcloud**. Uses the credentials from `gcloud auth application-default login`. Your gcloud credentials are not sent to Querylab.io.
- **Google OAuth**, with the button **Sign in with Google**. Opens your browser for the Google consent screen. The token is stored in your macOS Keychain or Windows Credential Manager.

The app highlights whichever method it can already use; both buttons work either way. A card with a problem shows the error and a re-check button, and the ADC card shows the exact `gcloud` command to run if nothing was found.

Below the cards are two checkboxes:

- **I agree to the Terms of Service and Privacy Policy** is required before either button responds.
- **Send anonymous usage data** is on by default; untick to opt out. It sends feature usage and error reports only, never your SQL, results, or table names.

Step 2 is project selection. If you signed in as the wrong account, click **Switch account** at the bottom of that screen to go back to step 1.

## OAuth scopes

### Requested at sign-in

| Scope                                | Why                           |
| ------------------------------------ | ----------------------------- |
| `userinfo.email`, `userinfo.profile` | Identify you to Querylab.io   |
| `bigquery`                           | Run queries and read metadata |

### Requested on first use only

None of these is asked for at sign-in. If you never use the feature, Querylab.io never asks for the scope.

| Scope                            | Feature                                                                                    |
| -------------------------------- | ------------------------------------------------------------------------------------------ |
| `cloudplatformprojects.readonly` | **Grant Access to Projects List** on the project step: lists every GCP project you can see |
| `drive.file`                     | Export results to Google Sheets; only files the export creates                             |
| `cloud-platform`                 | Saved queries and scheduled queries                                                        |

Each of these triggers a separate Google consent screen the first time. Settings → Privacy → Google Credentials shows which scopes your current token holds.

### ADC scopes

With local gcloud credentials Querylab.io can't ask for more: it gets whatever you granted when you ran the login. The default `gcloud auth application-default login` grants `cloud-platform`, which already covers BigQuery and project listing. Google Sheets export needs `drive.file` on top:

```bash
gcloud auth application-default login \\
  --scopes=openid,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/bigquery,https://www.googleapis.com/auth/drive.file
```

If the ADC account doesn't match the account you signed into Querylab.io with, the app refuses and shows the `--account=` command to fix it.

## Where tokens are stored

| Sign-in               | Storage                                                   |
| --------------------- | --------------------------------------------------------- |
| Web app               | On Querylab.io servers, so your session survives a reload |
| Desktop, Google OAuth | macOS Keychain or Windows Credential Manager              |
| Desktop, local gcloud | With gcloud, on your machine; nothing is copied           |

What else reaches our servers, and what never does: [Security and privacy](https://docs.querylab.io/getting-started/security-and-privacy/).

## Switching accounts

- During desktop setup, click **Switch account** on the project selection screen.
- After setup, open the account menu at the top right of the header and click **Logout**, then sign in again with the other account. For ADC, run `gcloud auth application-default login --account=you@example.com` first.
- On other devices: Settings → Privacy → Active Sessions lists where you're signed in; **Sign out of all other sessions** ends them.