Skip to main content
Connections are added inside an Access bundle. At claude.ai/admin-settings/claude-tag, open Access bundles in the left navigation, click into a bundle (or Create one), and go to its Credentials tab.
Connecting BigQuery lets Claude run queries against your datasets from any channel under the bundle’s scope. Add it as a custom credential with Connect another tool; BigQuery has no preset button in the picker. This is an HTTP API connection, not a personal claude.ai connector. Pair it with a plugin that covers BigQuery so Claude knows how to form and run queries; without one, Claude can reach the API but has to work out the request shape on its own. See Attach plugins.

​
Create the credential in Google Cloud

Create a dedicated service account for the agent in the Google Cloud project that holds your BigQuery data, then create a JSON key for it. Google’s guides cover creating a service account and creating a service account key.

​
Grant access to specific datasets

You scope what Claude can read on the Google Cloud side, through the service account’s role grants. The connection itself has no dataset setting. Grant the service account two roles:
  • BigQuery Data Viewer (roles/bigquery.dataViewer) on each dataset Claude should query. Grant it on the specific datasets, not on the project, so Claude can read only those datasets.
  • BigQuery Job User (roles/bigquery.jobUser) on the project, so the service account can run query jobs.
Together the two grants let Claude run read-only queries against those datasets. To widen or narrow access later, edit the dataset grants in Google Cloud; the connection needs no change.

​
Add the connection to a bundle

In the bundle, click Connect another tool and choose GCP access token (with Service Account Key).
FieldValue
Credential typeGCP access token (with Service Account Key)
GCP service account key (JSON)The JSON key file from Google Cloud Console
Scopes (optional)https://www.googleapis.com/auth/bigquery. The field is labeled optional, but leave it empty and the token defaults to a broader scope. BigQuery’s query endpoints don’t accept a read-only scope; the dataset roles in the section above are what keep the connection read-only.
Allowed websitesbigquery.googleapis.com
Agent Proxy exchanges the service-account key for an access token and injects it at the network boundary; the model and the sandbox are not given the key. See how Agent Proxy works.

​
Verify the connection

In a channel under the bundle’s scope, in a new thread: 
@Claude what can you access from this channel?
BigQuery appears in the list once the connection is live. New connections apply to new threads only. Then confirm a query runs against a dataset you granted: 
@Claude how many rows are in <dataset>.<table>?