> ## Documentation Index
> Fetch the complete documentation index at: https://learn.kubit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect BigQuery

> Enable the BigQuery API and create a read-only Kubit service account so Kubit queries your BigQuery data in place.

Kubit connects directly to BigQuery and queries your data in place. You enable the BigQuery API, create a read-only service account for Kubit and share its key. Nothing is copied out of your project. The setup takes about 15 minutes.

## Before you start

* [ ] Permission in the Google Cloud project to enable APIs, create service accounts and grant IAM roles (for example **Owner**, or **Service Account Admin** plus **Project IAM Admin**)
* [ ] The ID and location of the dataset Kubit should query

## Steps

### 1. Enable the BigQuery API

If the BigQuery API is already on for the project, skip this step.

In the Google Cloud console, open **APIs & Services** and click **Enable APIs and Services**. Search for `BigQuery API`, select it and click **Enable**.

### 2. Create a service account

Open **APIs & Services** > **Credentials** and select your project if asked. Click **Create Credentials** > **Service account**.

Name the account `Kubit` and click **Create**. The **Service account email** shown is the Kubit service account email.

### 3. Grant BigQuery roles

Give the Kubit service account these three roles on the project:

| Role | Why |
| - | - |
| **BigQuery User** | Lists datasets and runs queries in the project |
| **BigQuery Job User** | Runs query jobs |
| **BigQuery Data Viewer** | Reads table and view data |

The same grants from the command line, with `<project-id>` and the service account email replaced:

```bash theme={null}
for role in roles/bigquery.user roles/bigquery.jobUser roles/bigquery.dataViewer; do
  gcloud projects add-iam-policy-binding <project-id> \
    --member="serviceAccount:<kubit-service-account-email>" \
    --role="$role"
done
```

### 4. Create a JSON key

Select the Kubit service account, open **Keys** and click **Add Key** > **Create new key**. Choose **JSON** and click **Create**. A JSON private key downloads to your computer.

> [!WARNING]
>
> The JSON key gives read access to your BigQuery data. Store it in a password manager or secret store, never in a repo or chat message.

### 5. Add the connection in Kubit

Kubit needs three values: the **JSON private key**, the **dataset ID** and the dataset's **region and zone**.

![BigQuery Connection setup form](https://mintcdn.com/kubit/9i8QHxqek50tMBGy/images/warehouse/bigquery.png?fit=max\&auto=format\&n=9i8QHxqek50tMBGy\&q=85\&s=05e0deb3578098c36de8c02254447908)

For help with the setup, share the same three values with the Kubit team through a secure channel such as a password manager.

## Verify

Check that the service account has all three roles. The output lists `roles/bigquery.user`, `roles/bigquery.jobUser` and `roles/bigquery.dataViewer`.

```bash theme={null}
gcloud projects get-iam-policy <project-id> \
  --flatten="bindings[].members" \
  --filter="bindings.members:serviceAccount:<kubit-service-account-email>" \
  --format="value(bindings.role)"
```

## Next steps

* [Bring your own warehouse](https://learn.kubit.ai/warehouses/overview.md): how Kubit queries your warehouse in place.
* [Allow Kubit's IP ranges](https://learn.kubit.ai/warehouses/ip-allowlist.md): let Kubit through VPC Service Controls or a firewall.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.