> ## Documentation Index
> Fetch the complete documentation index at: https://docs.less.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# How to create a BigQuery service account

Use this when setting up a [BigQuery source](/sources/guides/bigquery) or [destination](/destinations/guides/bigquery). Less connects with a **Google Cloud service account JSON key** — the standard approach for server-to-server data pipelines.

<Tip>
  **OAuth is not supported yet** for BigQuery in Less. Google OAuth (sign in with your Google account) works for other Google connectors such as Google Sheets, but BigQuery requires a service account today. Service accounts are also what Google recommends for automated extract/load jobs.
</Tip>

<Steps>
  <Step title="Create or select a project">
    Open the [Google Cloud Console](https://console.cloud.google.com/) and select the project that contains your BigQuery datasets, or create a new project.

    Copy the **Project ID** (not the project name) — you will enter this as **Project ID** in Less.
  </Step>

  <Step title="Enable the BigQuery API">
    In the Cloud Console, go to **APIs & Services** → **Library**, search for **BigQuery API**, and click **Enable** if it is not already enabled for the project.
  </Step>

  <Step title="Create a service account">
    Go to **IAM & Admin** → **Service Accounts** → **Create service account**.

    Enter a name (for example `less-bigquery`) and optional description, then select **Create and continue**.
  </Step>

  <Step title="Grant BigQuery roles">
    Assign roles depending on how you use Less:

    * **Sources (read data)** — add **BigQuery Data Viewer** and **BigQuery Job User**.
    * **Destinations (write data)** — add **BigQuery Data Editor** and **BigQuery Job User**.

    You can grant roles at project level, or use dataset-level IAM for tighter access (see step 5).

    Select **Continue**, then **Done**.
  </Step>

  <Step title="Grant dataset access (recommended)">
    For least-privilege access, open **BigQuery** in the Cloud Console, select your **dataset** → **Sharing** → **Permissions** → **Add principal**.

    Enter the service account email (for example `less-bigquery@my-project.iam.gserviceaccount.com`) and assign:

    * **BigQuery Data Viewer** for sources
    * **BigQuery Data Editor** for destinations

    The service account still needs **BigQuery Job User** at project level so Less can run queries and load jobs.
  </Step>

  <Step title="Create and download a JSON key">
    Return to **IAM & Admin** → **Service Accounts**, open the service account you created, go to the **Keys** tab → **Add key** → **Create new key** → **JSON** → **Create**.

    A JSON file downloads automatically. Upload that file in the **Credentials** step of the BigQuery wizard in Less.

    <Warning>
      Store the key securely. Anyone with this file can access BigQuery as the service account. Rotate or delete keys you no longer use under **Keys** in the service account settings.
    </Warning>
  </Step>

  <Step title="Connect in Less">
    In the BigQuery wizard:

    1. **Account** — **Project ID**, optional default **dataset**, and optional **location** (for example `US` or `EU`).
    2. **Credentials** — upload the JSON key file from step 6.
    3. **Tables** (source) or **Test Connection** (destination) — click **Connect** to verify access.

    BigQuery is accessed over HTTPS; you do not need to whitelist Less IP addresses for Google Cloud.
  </Step>
</Steps>

## Troubleshooting

**Invalid service account JSON**

* Upload the original `.json` key file downloaded from Google Cloud.
* The file must contain `"type": "service_account"` and a `client_email` field.

**Access Denied or permission errors**

* Confirm **BigQuery Job User** is granted at project level.
* Confirm **BigQuery Data Viewer** (source) or **BigQuery Data Editor** (destination) is granted on the dataset or project.
* If you use a default **dataset** in Less, the service account must have access to that dataset.

**Not found: Dataset or table**

* Check the **Project ID** matches the project where the dataset lives.
* Dataset and table names are case-sensitive in BigQuery.

**Location errors**

* If datasets use a regional location (for example `europe-west1`), set the same **location** in the Less Account step.

**Further reading**

* [BigQuery IAM roles](https://cloud.google.com/bigquery/docs/access-control)
* [Create and delete service account keys](https://cloud.google.com/iam/docs/keys-create-delete)