Introduction to authentication

To use the BigQuery API, you must first authenticate to verify your client's identity. BigQuery authorizes access to resources based on the verified identity. These how-to guides show how to authenticate your clients and access the BigQuery API.

For more information about how to authenticate your clients to access Cloud APIs, see the Authentication overview.

Service accounts

A service account is a Google Account that is associated with your Google Cloud project. Use a service account to access the BigQuery API if your application can run jobs associated with service credentials rather than an end-user's credentials, such as a batch processing pipeline.

• Authenticating with Application Default Credentials
• Authenticating with a service account key file

User accounts

Use user credentials to ensure that your application has access only to BigQuery tables that are available to the end user. A user credential can run queries against only the end user's Google Cloud project rather than the application's project, meaning the user is billed for queries instead of the application.

• Authenticating with a user account in installed applications

Authorizing API requests

After you have authenticated your client, you must pass an access token to the BigQuery API so that it knows your client is authorized to access the requested resources. If you use the BigQuery client libraries, this is done for you automatically.

• If you are not using the client libraries, learn how to use access tokens in the authorization guide.