Google BigQuery
Connect a BigQuery project and dataset for governed source access or destination exports.
Last reviewed July 13, 2026
Source and destination — A BigQuery app can let Vendo query selected warehouse data and can receive supported event, user, advertising, conversion, or custom exports. The integrations you create determine the direction and data contract.
Connection Modes
| Mode | Credential owner | Recommended when |
|---|---|---|
| Vendo Service Account | Vendo displays a managed principal; your GCP administrator grants it access | You want keyless setup and centrally revocable IAM access |
| Bring Your Own Service Account | Your organization creates and uploads a JSON key | Your security policy requires a dedicated customer-owned principal |
The address shown in the current connection form is authoritative for managed access. Do not reuse a service-account address copied from an old ticket or guide.
Data Boundary
Project access is not the same as permission to every dataset. Select the intended dataset and grant only the roles and resources required by the agreed source or destination workflow.
At minimum, distinguish:
- read access for discovering schemas and querying source tables;
- job access for running BigQuery jobs in the project;
- write access when Vendo must create or update destination tables.
Use dataset-level IAM where practical. Avoid granting project-wide owner or editor roles.
Before You Connect
- confirm the GCP project and dataset with the data owner;
- decide whether Vendo will read, write, or do both;
- choose the access mode;
- identify data-location, retention, and residency requirements;
- define expected tables, identifiers, freshness, and reconciliation checks.
Verify the Connection
- Use Load Datasets in the BigQuery connection form.
- Select the intended dataset.
- Run the form’s access verification.
- Confirm read and write results match the planned direction.
- Create the source or destination integration.
- Run a narrow test and inspect the actual table or query result.
Connection validation proves that credentials and IAM work. It does not prove that a mapping, schedule, or downstream consumer is correct.
Security
- Store service-account JSON only in Vendo’s credential form; never in docs, source control, or support messages.
- Rotate a customer-owned key according to your organization’s policy.
- Revoke the principal when the connection is retired.
- Review integration logs and GCP audit logs after permission changes.