Google BigQuery
The BigQuery connector reads dataset, table, and column metadata from one Google Cloud project using a service account. You never enter a hostname — the connector only talks to Google's fixed API endpoints.
Connection settingsDirect link to Connection settings
| Field | Required | Notes |
|---|---|---|
projectId | Yes | The Google Cloud project to discover (6–30 characters, Google's project-id rules). |
location | No | Defaults to US. One location per connector, chosen from a fixed supported set: the US and EU multi-regions plus common single regions (for example us-central1, europe-west1, asia-northeast1). An unsupported location is refused, never coerced. |
clientEmail | Yes | The service account's email, ending in .gserviceaccount.com. It must match the client_email inside the key file, or the configuration is refused. |
datasets | No | Optional list of dataset ids (up to 500) to limit discovery. Omitted or empty means every dataset the service account can see. |
serviceAccountJson | Yes | The full service-account JSON key file, pasted verbatim (up to 8192 characters). Stored in Supabase Vault and never shown again after saving. |
Testing the connection lists at most one dataset id — a minimal-permission metadata probe.
What gets discoveredDirect link to What gets discovered
BigQuery has no database layer, so the connector models your project as a single synthetic catalog database named after projectId, with each dataset appearing as a schema. Tables and columns come from region-qualified INFORMATION_SCHEMA metadata queries, with data type and nullability per column. Column descriptions are not read.
Network and egressDirect link to Network and egress
This connector uses a closed endpoint inventory: it connects only to bigquery.googleapis.com and oauth2.googleapis.com. From your key file it extracts only the client email and private key — the endpoint fields a key file can carry (token_uri, auth_uri, auth_provider_x509_cert_url, client_x509_cert_url) are dropped and never honored, so a tampered key file cannot redirect traffic. As defense in depth, the Google hostnames are also checked against Metatate's private-address refusal before any socket opens.
For the shared lifecycle, sync scope, and snapshot behavior, see the connectors overview.