Connecting to BigQuery
Querylab.io runs your queries against BigQuery with your own Google credentials. In the browser that means a Google sign-in; on the desktop you can also reuse the gcloud credentials already on your machine. Either way the query goes from your device to BigQuery — never through Querylab.io.
Choose how you want to access BigQuery. This allows you to view your data, run queries, and fully interact with BigQuery.
Grant BigQuery Access (OAuth)
Encrypted (AES-256) on our servers. Queries run directly from your browser to BigQuery - our backend never executes queries.
Try Playground
Explore Querylab.io with sample data — no BigQuery access required.
Which one to pick
| Web app | Desktop app | |
|---|---|---|
| Sign-in | Google OAuth | Google OAuth or local gcloud (ADC) |
| Where the token lives | Encrypted (AES-256) on Querylab.io servers | Your OS keychain, or gcloud’s own credential file |
| Who talks to BigQuery | Your browser | The app |
| Setup | Under a minute | Under a minute, or 2–3 minutes if you install gcloud first |
The two are equally private about your data: results never pass through Querylab.io. They differ only in where the access token is kept. If you’d rather it never left your machine, use the desktop app.
Web app
- A Google account with access to at least one BigQuery project
- The BigQuery API enabled on that project
- Open app.querylab.io, tick I agree to the Terms of Service and Privacy Policy, and click Continue with Google.
- Pick your Google account. This first step asks only for your email and profile.
- On the Grant BigQuery access step, click Grant Access and approve the BigQuery permission on Google’s consent screen.
- Choose the projects you want in the IDE and click Save Changes and Start Using.
If none of your projects has BigQuery enabled or billing set up, the setup step says so and offers Try with sample data — see Playground.
Desktop app
The desktop app asks you to choose a method before anything else:
Either method keeps tokens on your machine and calls go straight to the BigQuery API.
Local gcloud (ADC) — Reuse your existing Application Default Credentials.
Google OAuth — Standard browser sign-in.
Google OAuth
Click Sign in with Google. Your browser opens, you approve the Google consent screen, and the app picks the token up when you come back. The token is written to the OS keychain (macOS Keychain, Windows Credential Manager, or the Linux secret service) and is never sent to Querylab.io.
Local gcloud (ADC)
Use this if you already work with Google Cloud from the terminal.
- Install the Google Cloud CLI.
- Run
gcloud auth application-default loginand finish the sign-in in the browser. - Back in the app, the card shows a green check once it finds the credentials. Click Continue with local gcloud.
Querylab.io reads ~/.config/gcloud/application_default_credentials.json and refreshes tokens through gcloud. Nothing is copied anywhere else. If the app opened before you ran the command, use the re-check button on the card instead of restarting.
Security details
- Queries never touch Querylab.io servers. The browser or desktop app calls the BigQuery API directly. Results come back the same way and are never uploaded.
- Web app tokens are stored encrypted with AES-256 on Querylab.io servers, so the session can be refreshed without asking you to sign in again.
- Desktop app tokens stay on your device: in the OS keychain for Google OAuth, in gcloud’s credential file for ADC.
- Revoke at any time. Remove Querylab.io under Google Account → Third-party access. For ADC, run
gcloud auth application-default revoke. - See what was granted. Settings → Privacy → Google Credentials lists the scopes on your current token. The scope reference is on the Authentication page.
Not ready to connect?
Click Try Playground on the access step (or pick Playground on the sign-in page) to use the IDE against sample data without a Google account. Details and limits: Playground.