BigQuery

1. Create a service account

What: Create a service account so Querio can securely access BigQuery.

How:

1. Go to Google Cloud Console > IAM & Admin > Service Accounts
2. Click Create service account
3. Name it something clear, like querio-data-access
4. Add a description if helpful
5. Click Create and continue

2. Assign required roles

What: Give the service account permission to run jobs and read the datasets Querio should query.

How:

1. Add the BigQuery Job User role
2. Add BigQuery Data Viewer at the project level or only on the specific datasets Querio should access
3. Ensure the service account has the bigquery.readsessions.create permission (you can grant the BigQuery Read Session User role for this)

If you do not want Querio to access every dataset in the project, only grant BigQuery Data Viewer on the specific datasets. The BigQuery Job User and BigQuery Read Session User roles are still needed at the project level.

3. Create a JSON key

What: Generate the key file Querio uses to authenticate.

How:

1. Open the service account
2. Go to Keys
3. Click Add key > Create new key
4. Choose JSON
5. Download the file and store it securely

4. Share the key securely

Share the JSON key with Querio using a secure transfer method.

5. Optional: grant dataset-specific access

If you are scoping access by dataset:

1. Open BigQuery in Google Cloud Console
2. Open the dataset Querio should access
3. Go to Sharing > Permissions
4. Add the service account email
5. Grant BigQuery Data Viewer