# Connecting to BigQuery

> Querylab.io runs your queries against BigQuery with your own Google credentials. In the browser that means a Google sign-in; on the desktop you can also reuse the gcloud credentials already on your machine. Either way the query goes from your device to BigQuery, never through Querylab.io.

Source: https://docs.querylab.io/getting-started/connecting-to-bigquery/

**app.querylab.io → Step 2 of 2 · Access**

<p>
      Choose how you want to access BigQuery. This allows you to view your data,
      run queries, and fully interact with BigQuery.
    </p>
    <p>
      <b>Grant BigQuery Access (OAuth)</b>
      <br />
      Encrypted (AES-256) on our servers. Queries run directly from your browser
      to BigQuery - our backend never executes queries.
    </p>
    <p>
      <b>Try Playground</b>
      <br />
      Explore Querylab.io with sample data — no BigQuery access required.
    </p>

The access step after signing in. On the desktop app the first card is Use Local Credentials (ADC) instead.

## Which one to pick

|                       | Web app                | Desktop app                        |
| --------------------- | ---------------------- | ---------------------------------- |
| Sign-in               | Google OAuth           | Google OAuth or local gcloud (ADC) |
| Where the token lives | On Querylab.io servers | Your OS keychain, or with gcloud   |
| Who talks to BigQuery | Your browser           | The app                            |

If you'd rather the token never left your machine, use the desktop app. If your
organisation restricts which third-party apps may be granted Google API access, use the
desktop app's local gcloud option. It signs in through gcloud, which your company
already allows if you use Google Cloud from the terminal, so there is no Querylab.io
grant for an admin to approve.

## Web app

- A Google account with access to at least one BigQuery project
  - The BigQuery API enabled on that project

1. Open [app.querylab.io](https://app.querylab.io), tick **I agree to the Terms of Service and Privacy Policy**, and click **Continue with Google**.
2. Pick your Google account. This first step asks only for your email and profile.
3. On the **Grant BigQuery access** step, click **Grant Access** and approve the BigQuery permission on Google's consent screen.
4. Choose the projects you want in the IDE and click **Save Changes and Start Using**.

> **Stuck on Grant BigQuery access?** Many companies allow third-party apps only after an admin approves them, so step 3   can fail or sit waiting for IT. You do not have to wait. The desktop app signs in   with the Google credentials already on your machine, so there is nothing for anyone   to approve: ```bash gcloud auth application-default login ``` The app picks those up on its own. The tokens stay on your machine and Querylab.io never receives them. Everything else works as it does on the web. See [Local gcloud (ADC)](#local-gcloud-adc).

If none of your projects has BigQuery enabled or billing set up, the setup step says so and offers **Try with sample data**. See [Playground](https://docs.querylab.io/getting-started/playground/).

## Desktop app

The desktop app asks you to choose a method before anything else:

**Step 1 of 2 · Authentication**

<p>
      Either method keeps tokens on your machine and calls go straight to the
      BigQuery API.
    </p>
    <p>
      <b>Local gcloud (ADC)</b> — Reuse your existing Application Default
      Credentials.
      <br />
      <b>Google OAuth</b> — Standard browser sign-in.
    </p>

The app outlines whichever card it can already use.

### Google OAuth

Click **Sign in with Google**. Your browser opens, you approve the Google consent screen, and the app picks the token up when you come back. The token is stored in the macOS Keychain or the Windows Credential Manager and is never sent to Querylab.io.

### Local gcloud (ADC)

Use this if you already work with Google Cloud from the terminal.

1. Install the [Google Cloud CLI](https://cloud.google.com/sdk/docs/install).
2. Run `gcloud auth application-default login` and finish the sign-in in the browser.
3. Back in the app, the card shows a green check once it finds the credentials. Click **Continue with local gcloud**.

Nothing is copied; the app asks gcloud for a token. If the app opened before you ran the command, use the re-check button on the card instead of restarting.

> **ADC only has the scopes you gave gcloud.** `gcloud auth application-default login` grants `cloud-platform` by default,   which covers BigQuery and project listing. If a feature later reports a   missing scope, re-run the command with `--scopes=…`. See   [Authentication](https://docs.querylab.io/getting-started/authentication/#oauth-scopes).

## Security details

- **Revoke at any time.** Remove Querylab.io under [Google Account → Third-party access](https://myaccount.google.com/permissions). For ADC, run `gcloud auth application-default revoke`.
- **See what reaches our servers.** Everything the app sends, and where, is on [Security and privacy](https://docs.querylab.io/getting-started/security-and-privacy/).
- **See what was granted.** Settings → Privacy → Google Credentials lists the scopes on your current token. The scope reference is on the [Authentication](https://docs.querylab.io/getting-started/authentication/) page.

## Not ready to connect?

Click **Try Playground** on the access step (or pick **Playground** on the sign-in page) to use the IDE against sample data without a Google account. Details and limits: [Playground](https://docs.querylab.io/getting-started/playground/).