Authentication
Querylab.io has no password of its own. It signs you in with Google, asks for the BigQuery scope, and asks for further scopes only when a feature needs them. On the desktop the token stays on your machine; on the web it is stored encrypted so your session can be refreshed without signing in again.
Connect your data
Sign in with Google to query your own BigQuery projects. Data flows directly between your browser and Google. Querylab.io never stores or processes it.
Playground
Explore Querylab.io without connecting your data. BigQuery access not needed.
☐ I agree to the Terms of Service and Privacy Policy
Web app
Tick the agreement checkbox and click Continue with Google. The first Google prompt asks only for your email and profile — that identifies you to Querylab.io. The BigQuery permission comes on the next step, Grant BigQuery access, when you click Grant Access. After that you pick your projects and you’re in.
Desktop app
The desktop app starts with Step 1 of 2 · Authentication and two cards:
- Local gcloud (ADC), with the button Continue with local gcloud. Uses the credentials from
gcloud auth application-default login. Nothing is sent to Querylab.io. - Google OAuth, with the button Sign in with Google. Opens your browser for the Google consent screen. The token is written to your OS keychain.
While the screen loads, the app probes for gcloud credentials. If it finds valid ones, the ADC card gets the highlighted border and filled button; otherwise Google OAuth does. That’s a hint, not a restriction — both buttons work either way. A card with a problem shows the error and a re-check button, and the ADC card shows the exact gcloud command to run if nothing was found.
Below the cards are two checkboxes:
- I agree to the Terms of Service and Privacy Policy is required before either button responds.
- Send anonymous usage data is on by default; untick to opt out. It sends feature usage and error reports only, never your SQL, results, or table names.
Step 2 is project selection. If you signed in as the wrong account, click Switch account at the bottom of that screen to go back to step 1.
OAuth scopes
Requested at sign-in
| Scope | Why |
|---|---|
userinfo.email, userinfo.profile | Identify you to Querylab.io |
bigquery | Run queries and read metadata |
Requested when you first use the feature
| Scope | Feature |
|---|---|
cloudplatformprojects.readonly | Grant Access to Projects List on the project step — lists every GCP project you can see |
cloud-platform | Scheduled queries and saved queries (BigQuery Data Transfer API) |
drive.file | Export results to Google Sheets — only files the export creates |
Each of these triggers a separate Google consent screen the first time. Settings → Privacy → Google Credentials shows which scopes your current token holds.
ADC scopes
With local gcloud credentials Querylab.io can’t ask for more: it gets whatever you granted when you ran the login. The default gcloud auth application-default login grants cloud-platform, which already covers BigQuery, project listing, and scheduled queries. Google Sheets export needs drive.file on top:
gcloud auth application-default login \ --scopes=openid,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/bigquery,https://www.googleapis.com/auth/drive.file
If the ADC account doesn’t match the account you signed into Querylab.io with, the app refuses and shows the --account= command to fix it.
Where tokens are stored
| Sign-in | Storage |
|---|---|
| Web app | Encrypted with AES-256 on Querylab.io servers |
| Desktop, Google OAuth | OS keychain — macOS Keychain, Windows Credential Manager, Linux secret service |
| Desktop, local gcloud | ~/.config/gcloud/application_default_credentials.json, managed by gcloud |
In every case the query itself goes from your device to BigQuery. See Security details.
Switching accounts
- During desktop setup, click Switch account on the project selection screen.
- After setup, open the account menu at the top right of the header and click Logout, then sign in again with the other account. For ADC, run
gcloud auth application-default login --account=you@example.comfirst. - On other devices: Settings → Privacy → Active Sessions lists where you’re signed in; Sign out of all other sessions ends them.