Connect your app to BigQuery

1. 1

   Decide if you want to connect using your Google account or a special Google Cloud service account.

   Connecting with your Google account is quicker for individuals and prototypes, while using a service account is better for teams and production apps because it's not tied to one person.

2. 2

   If using your Google account, make sure it has permission to run BigQuery jobs and view the datasets you need.

   Your app can only do what your Google account is allowed to do in BigQuery.

3. 3

   If using a service account, you'll need to set up 'Workload Identity Federation' in Google Cloud first, which involves running a script or following manual steps to create a pool and provider.

   This setup allows Lovable to securely act on behalf of your Google Cloud service account without you ever sharing sensitive keys.

4. 4

   Go to 'Connectors' in Lovable and select 'BigQuery'.

   This is where you manage all your connections to outside services.

5. 5

   Click 'Add connection', give it a clear name, and choose your connection method ('Connect with Google' or 'Use your own credentials').

   A clear name helps you identify the connection later, and selecting the right method ensures the connection is set up correctly.

6. 6

   Provide the Google Cloud project ID that will be used for billing and running queries.

   BigQuery costs are handled by Google Cloud, and this tells Google which project to bill.

7. 7

   If using 'Connect with Google', sign in with your Google account and approve the access request.

   This links your Google account's permissions to the Lovable connection.

8. 8

   If using 'Use your own credentials', paste the 'WIF Audience' and 'Service Account Email' you got from the Google Cloud setup script.

   These details tell Lovable how to securely impersonate your Google Cloud service account.

9. 9

   Choose who in your workspace can use this connection.

   You can keep it private or share it with your team so others can use BigQuery in their apps.

10. 10

    Click 'Connect' to finalize the setup.

    This saves your connection settings in Lovable.

I want to connect my Lovable app to Google BigQuery. I need to be able to run SQL queries and explore my datasets. I'll use the 'Connect with Google' option for now. Can you guide me through the steps in Lovable, including what Google Cloud project ID to use and how to share the connection?

OAuth

A secure way for you to give an app like Lovable permission to use information from another service (like Google) without sharing your password.

Workload Identity Federation (WIF)

A secure method in Google Cloud that lets services like Lovable act on behalf of a special Google Cloud account (a 'service account') without needing to store secret keys. It's like giving a trusted assistant a temporary badge to do specific tasks.

Service Account

A special Google Cloud account used by applications and services, not by a person. It has its own permissions and can perform actions within your Google Cloud projects.

GCP keys

Secret codes or files that grant access to your Google Cloud resources. Storing them directly in your project can be risky if they fall into the wrong hands.

Standard SQL

A common language used to ask questions and get information from databases, understood by many database systems including BigQuery.

Schema metadata

Information about the structure of your data, like the names of your databases, tables, and what kind of data is in each column.

Parameterized queries

Database questions where some parts are left blank to be filled in later, making them flexible and safer against certain types of attacks.

Views

Virtual tables in a database that show data from one or more real tables, but don't store the data themselves. They're like saved searches.

Materialized views

Similar to views, but they actually store the results of a query as a physical table. This makes them faster to access, especially for frequently used data.

IAM permissions

Rules in Google Cloud that control who (or what service account) can do what actions on which resources. It stands for Identity and Access Management.

Connector gateway

A secure middleman service provided by Lovable that handles communication between your app and external services like BigQuery, managing security tokens and requests.

Scopes

Specific permissions requested by an application when you connect it to a service like Google. They define what the app is allowed to try and do (e.g., 'view your data').

OIDC provider

A service that verifies identities using the OpenID Connect standard. In this case, it helps Google Cloud trust identity tokens coming from Lovable.

• Your app's ability to read or write data in BigQuery is limited by the permissions of the Google account or service account you connect with, even if Lovable requests broad access.
• If you connect using your personal Google account, the connection will stop working if that account loses access to BigQuery or is removed.
• BigQuery costs (for queries and storage) are billed directly by Google Cloud to your GCP billing account, not by Lovable.
• When setting up Workload Identity Federation, ensure the Google Cloud project selected in Cloud Shell is the correct one.
• If you manually update dataset access in Google Cloud, be aware that `bq update --source` replaces the entire access control list, so ensure all desired entries are present in your JSON file.
• IAM bindings in Google Cloud can take up to 5 minutes to fully take effect, so don't expect immediate results after making changes.