Overview

Database form

In order to connect to a BigQuery database, you will need a service account in Google Cloud Platform (GCP) with permissions to access your data.

Then, in the app, enter the Project ID, Service Account Email and Private Key to let Steep connect to your BigQuery project.

Project ID
Example: myproject-123456

Email
Example: user@myproject-123456.iam.gserviceaccount.com

Private Key
Example:

-----BEGIN PRIVATE KEY-----\n
MIIEvgIBADANBgkq…F6HhhtvY\n
-----END PRIVATE KEY-----\n

Make sure to copy the entire private key string.

Setting up a service account

We recommend that you set up a new service account specifically for Steep. See below for a step-by-step guide.

1. New service account

Head to the GCP console and navigate to the IAM & admin > Service Account section. https://console.cloud.google.com/iam-admin/serviceaccounts

Select Create Account.

2. Add Roles

Name the service account and in the second step, add the BigQuery Data Viewer and the BigQuery Job User role. Save the account.

3. Create and download JSON Key

In the Service Account overview, open the Actions menu for your service account and select Manage keys.

Configure BigQuery

Next, on the Keys overview, select Add key and Create new key. Pick JSON as key type and download the json file.

4. Enter service account details in Steep

Open the downloaded json file in a text editor. Copy and paste the strings for project_id, client_email and private_key to the corresponding fields in the database form in Steep.

Test the connection to make sure things are working fine.

Example JSON Key file

{
  "type": "service_account",
  "project_id": "myproject-123456",
  "private_key_id": "efb9f928a3869d2d20c87e108405d7f0bf68a753",
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIuTx+U=\n-----END PRIVATE KEY-----\n",
  "client_email": "steep@myproject-123456.iam.gserviceaccount.com",
  "client_id": "123456789",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/steep%40myproject-123456.iam.gserviceaccount.com"
}

If you want to create a more specific role, Steep requires the following permissions:
bigquery.datasets.get
bigquery.jobs.create
bigquery.tables.get
bigquery.tables.getData
bigquery.tables.list

Troubleshooting

I get the following error when connecting my data source error:1E08010C:DECODER routines::unsupported

The private key you entered is likely malformed or incomplete in some way, double check it and make sure the private key is entered in the format -----BEGIN PRIVATE KEY-----\nMII…tvY\n-----END PRIVATE KEY-----\n as described above.

I get the following error when connecting my data source invalid_grant: Invalid JWT Signature

The private key you entered is likley not valid. Check its validity and generate a new private key for your service account if needed.