Connect BigQuery changedclaude-tag/admins/connections/bigquery
Nearest release: v2.1.290, published under an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 5 Oct 2026 18:53 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 5 Oct 2026 19:07 UTC.
Upstream edited
Recorded here
Lines+10added
Lines−17removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits5to this page, all time
## Add the connector ## Add the connection to a bundle
The whole hunk
from line 1, old and new numbered
/
from line 1
11# Connect BigQuery
22
3> Connect BigQuery to Claude Tag so it can run read-only queries on your datasets. BigQuery has no preset, so it is added as a custom credential with a GCP service-account key.
3> Connect BigQuery to Claude Tag so it can run read-only queries on your datasets, using a GCP service-account key.
44
55export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
66
77<BetaNote />
88
9<Note>Connections are added inside an [Access bundle](/docs/claude-tag/admins/add-connections#your-first-access-bundle). At [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open **Access bundles** in the left navigation, click into a bundle (or **Create** one), and go to its **Credentials** tab.</Note>
9Connecting BigQuery lets Claude run queries against your datasets in any channel where the connector is on. Claude connects with its own credential, not a person's.
1010
11Connecting BigQuery lets Claude run queries against your datasets from any channel under the bundle's scope. Add it as a custom credential with **Custom tool**; BigQuery has no preset button in the picker.
11This connector calls BigQuery's HTTP API, and it's separate from members' personal claude.ai connectors. Pair it with a plugin that covers BigQuery so Claude knows how to form and run queries; without one, Claude can reach the API but has to work out the request shape on its own. Add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab.
1212
13This is an HTTP API connection, not a personal claude.ai connector. Pair it with a plugin that covers BigQuery so Claude knows how to form and run queries; without one, Claude can reach the API but has to work out the request shape on its own. See [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins).
14
1513## Create the credential in Google Cloud
1614
1715Create a dedicated service account for the agent in the Google Cloud project that holds your BigQuery data, then create a JSON key for it. Google's guides cover [creating a service account](https://cloud.google.com/iam/docs/service-accounts-create) and [creating a service account key](https://cloud.google.com/iam/docs/keys-create-delete).
from line 16
1816
1917## Grant access to specific datasets
2018
21You scope what Claude can read on the Google Cloud side, through the service account's role grants. The connection itself has no dataset setting. Grant the service account two roles:
19You scope what Claude can read on the Google Cloud side, through the service account's role grants. The connector itself has no dataset setting. Grant the service account two roles:
2220
2321* **BigQuery Data Viewer** (`roles/bigquery.dataViewer`) on each dataset Claude should query. Grant it on the specific datasets, not on the project, so Claude can read only those datasets.
2422* **BigQuery Job User** (`roles/bigquery.jobUser`) on the project, so the service account can run query jobs.
2523
26Together the two grants let Claude run read-only queries against those datasets. To widen or narrow access later, edit the dataset grants in Google Cloud; the connection needs no change.
24Together the two grants let Claude run read-only queries against those datasets. To widen or narrow access later, edit the dataset grants in Google Cloud; the connector needs no change.
2725
28## Add the connection to a bundle
26## Add the connector
2927
30In the bundle, click **Connect** next to **Custom tool** and choose **GCP access token (with Service Account Key)**.
28Go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click **Add**, and select **BigQuery**. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections#add-a-connection) before you save the connector. In the connect form, paste the whole JSON key file from Google Cloud Console into **Claude's service account key (JSON)**, then click **Connect** to save the connector.
3129
32| Field | Value |
33| :- | :- |
34| Credential type | **GCP access token (with Service Account Key)** |
35| GCP service account key (JSON) | The JSON key file from Google Cloud Console |
36| Scopes (optional) | `https://www.googleapis.com/auth/bigquery`. The field is labeled optional, but leave it empty and the token defaults to a broader scope. BigQuery's query endpoints don't accept a read-only scope; the dataset roles in the section above are what keep the connection read-only. |
37| Allowed websites | `bigquery.googleapis.com` |
30The access tokens Claude gets from this key carry only Google's `cloud-platform.read-only` scope, so Google refuses BigQuery API calls that create or delete tables or run load jobs. Queries still run with whatever the service account's roles allow, so the [dataset roles](#grant-access-to-specific-datasets) decide what a query can reach.
3831
3932Agent Proxy exchanges the service-account key for an access token and injects it at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity#agent-proxy).
4033
4134## Verify the connection
4235
43In a channel under the bundle's scope, in a new thread:
36In a channel where the connector is on, in a new thread:
4437
4538```text wrap theme={null}
4639@Claude what can you access from this channel?
4740```
4841
49BigQuery appears in the list once the connection is live. New threads pick up the connection on their own; in an existing thread, ask Claude to use the service by name.
42BigQuery appears in the list once the connector is live. New threads pick up the connector on their own; in an existing thread, ask Claude to use the service by name.
5043
5144Then confirm a query runs against a dataset you granted:
5245
No line in this hunk matches that.