BigQuery Integration

Connect your Google BigQuery data warehouse to Querri and query petabyte-scale datasets using natural language. Analyze large-scale data, run complex analytics, and explore your data warehouse without writing SQL.

What is BigQuery?

Google BigQuery is a fully managed, serverless data warehouse that enables super-fast SQL queries using the processing power of Google’s infrastructure. It’s designed for analyzing massive datasets quickly and cost-effectively.

Use cases:

Large-scale analytics on terabytes/petabytes of data
Business intelligence and reporting
Machine learning data preparation
Log analytics and monitoring
Data lake queries

Connecting BigQuery

BigQuery uses OAuth 2.0 authentication for secure, password-free access to your data warehouse.

Prerequisites

Before connecting, ensure you have:

A Google Cloud account with BigQuery enabled
At least one BigQuery project with datasets
Appropriate permissions to access BigQuery data (BigQuery Data Viewer role minimum)
Billing enabled on your Google Cloud project

Connection Steps

Go to Settings → Connectors (/settings/connectors)
Find BigQuery in the Database category
Click Connect
A popup opens to Google’s authorization page
Sign in to your Google account (if not already signed in)
Select your Google Cloud project
Review the permissions Querri is requesting
Click Allow to grant access
The popup closes automatically
Select your dataset and optionally specific tables
The connector is now active

Permissions requested:

View and run BigQuery jobs
Read data from BigQuery tables
View BigQuery metadata (projects, datasets, tables)

Note: Querri requests read-only access and cannot modify, delete, or create tables in your BigQuery instance.

OAuth Authentication & Troubleshooting

Understanding OAuth Token Issues

If you’re using a Google Workspace account (not a personal Gmail account), you may experience frequent reauthentication prompts. This is due to Google Workspace session control policies, not a problem with Querri.

Common Symptoms

Forced reauthentication every 8-24 hours (default: 16 hours)
OAuth refresh tokens that stop working
Constant “Please sign in again” prompts
Only affects Google Workspace accounts (Enterprise, Business, Education plans)
Personal Gmail accounts work without issues

Root Causes

There are three common causes for token expiration:

1. Google Workspace Reauthentication Policy (Most Common)

Google Workspace has a security feature called “Google Cloud session control”
Default setting: Requires reauthentication every 16 hours
This is independent of OAuth permissions
Affects: Google Workspace accounts only
Fix: Workspace admin must configure trusted app exemption (see below)

2. OAuth Consent Screen in Testing Mode

Apps in “Testing” mode: Refresh tokens expire after 7 days
Fix: Contact your administrator to publish the OAuth app to Production

3. 50 Refresh Token Limit

Google limits: 50 tokens per user per OAuth client
Fix: Revoke old tokens at myaccount.google.com/permissions, then reauthenticate

Solution for Google Workspace Users

For Google Workspace Administrators

If your users are experiencing repeated authentication prompts, you can configure two settings to allow long-lived OAuth tokens:

Prerequisites:

Super Admin or Security Admin role
Google Workspace Enterprise or Education Plus/Standard edition
OAuth app has been used at least once (so it appears in admin console)

Step 1: Mark the OAuth App as “Trusted”

Go to admin.google.com
Navigate to: Security → Access and data control → API controls (or “App access control”)
Find “Querri” or the BigQuery OAuth app in the list
Click on it → Change access
Select: “Trusted: Can access all Google services”
Click Save

What “Trusted” means: According to Google’s documentation, marking an app as “Trusted” does NOT grant additional permissions. It only exempts the app from reauthentication timers. The app is still limited to its OAuth scopes (read-only BigQuery access).

Step 2: Enable “Exempt Trusted Apps”

In Admin Console, navigate to: Security → Access and data control → Google Cloud session control
Find and check the box: ☑ “Exempt trusted apps”
Click Save
Changes take 5-15 minutes to propagate (sometimes up to 24 hours)

Official documentation: Set session length for Google Cloud services

Step 3: Users Reauthenticate

After making these changes:

Users should disconnect their existing BigQuery connector in Querri
Create a new BigQuery connector
Authenticate again
The new refresh token will now work indefinitely

For End Users (Non-Admins)

If you’re experiencing frequent reauthentication prompts, forward this information to your IT team:

Subject: Request: Configure BigQuery OAuth Integration for Querri

Hi [IT Admin Name],

I'm using Querri with BigQuery and am being forced to reauthenticate every 16 hours
due to our Google Workspace session control policy. Could you please make the following
configuration changes? This will allow OAuth refresh tokens to work properly without
compromising security.

STEP 1: Mark the OAuth App as Trusted
1. Go to: https://admin.google.com
2. Navigate to: Security → Access and data control → API controls
3. Find "Querri" or the BigQuery OAuth app
4. Click → "Change access" → Select "Trusted: Can access all Google services"
5. Save

Note: Per Google's documentation (https://support.google.com/a/answer/7281227),
this doesn't give the app more permissions - it only exempts it from reauthentication
timers. The app still only has read-only BigQuery access.

STEP 2: Enable "Exempt Trusted Apps"
1. In Admin Console: Security → Access and data control → Google Cloud session control
2. Check the box: ☑ "Exempt trusted apps"
3. Save

Official documentation:
- About trusted apps: https://support.google.com/a/answer/7281227
- Session control: https://support.google.com/a/answer/9368756

After these changes, I'll disconnect my old connector and reauthenticate to get
a new refresh token with the updated policy.

Thank you!
[Your Name]

Checking Your Google Workspace Edition

Not all Google Workspace editions support “Exempt trusted apps”:

Supported Editions:

✅ Google Workspace Enterprise (Standard, Plus)
✅ Google Workspace for Education (Plus, Standard)
❌ NOT available in: Business Starter, Business Standard, Business Plus, Essentials

To check your edition:

Go to admin.google.com
Navigate to: Account → Account settings → Profile
Look for “Edition” or “Plan”

Alternatives for Non-Enterprise Editions

If your Workspace edition doesn’t support “Exempt trusted apps”:

Option 1: Increase Session Length

In Google Cloud session control settings
Change reauthentication from “Every 16 hours” to “Every 24 hours” (maximum)
Users reauthenticate once per day instead of multiple times

Option 2: Use Personal Gmail Account

Personal Gmail accounts don’t have session control policies
No reauthentication issues
Not suitable for company data

Option 3: Use Service Account (For Server-Side Only)

Create a Google Cloud Service Account
Grant it BigQuery permissions via IAM
Service accounts don’t have refresh token issues
Good for: Backend services, automated reports, ETL processes
Not good for: User-specific data access

Security and Trust Explained

Common concern: “If I mark an app as ‘Trusted’, can it access everything?”

Answer: No. “Trusted” is a misleading name. Here’s what it actually controls:

Component	What It Controls	Who Sets It
OAuth Scopes	What data/services the app can access	App developer (fixed in code)
“Trusted” Status	Whether app bypasses reauthentication timers	Workspace admin (per organization)

What Querri’s OAuth scopes allow:

✅ Read BigQuery data (already granted via OAuth)
✅ List Google Cloud projects (read-only)
✅ View BigQuery metadata

What marking as “Trusted” does NOT allow:

❌ Access Gmail (not in our OAuth scopes)
❌ Write to BigQuery (we only request read-only)
❌ Access Drive (not in our OAuth scopes)
❌ Any access beyond our declared scopes

Think of it this way:

OAuth scopes = Giving someone keys to specific rooms
“Trusted” status = Letting them keep the keys vs. collecting them daily

Additional Troubleshooting

Issue: Changes made but still getting prompted to reauthenticate

Checklist:

App is marked as “Trusted” in API controls
“Exempt trusted apps” is checked in Google Cloud session control
You deleted old connectors and created new ones
You waited 15+ minutes for changes to propagate
The OAuth Client ID matches between Admin Console and the app

Issue: Can’t find ‘API controls’ or ‘App access control’

Solutions:

Verify you have Super Admin or Security Admin role
Use the search box at the top and type “API controls”
Make sure you’re in Security → Access and data control (not Apps → Marketplace apps)

Issue: Tokens still expire after a few days

This indicates a different issue:

Check if OAuth consent screen is in “Testing” mode (should be “Published”)
You may have hit the 50 token limit - revoke old tokens at myaccount.google.com/permissions

Issue: I don’t see ‘Exempt trusted apps’ checkbox

Possible causes:

Must mark app as trusted first (Step 1)
Check in “Advanced settings” or “Exceptions” section
Verify you have Enterprise or Education Plus edition (required for this feature)

What You Can Access

Once connected, you can:

Query tables and views in your selected datasets
Run complex analytical queries across multiple tables
Access nested and repeated fields in BigQuery tables
Explore table schemas and metadata
Aggregate and analyze large datasets
Join tables within BigQuery

Selecting Projects and Datasets

Projects

When you connect BigQuery, you’ll see a list of your Google Cloud projects. Select the project containing the datasets you want to query.

If you have multiple projects:

You can connect multiple BigQuery instances
Give each instance a descriptive name (e.g., “Analytics Project”, “Marketing Data”)
Each instance can access different projects or datasets

Datasets

After selecting a project, choose which dataset(s) to access:

Single dataset: Select one specific dataset
Multiple datasets: You can query across datasets in the same project

Dataset naming:

Use clear, descriptive names
Follow your organization’s naming conventions
Document what each dataset contains

Working with BigQuery Data

Once your BigQuery connection is active, Querri automatically discovers your datasets and tables. Here’s how to start analyzing your data warehouse:

Tables Appear in Your Library

After connecting BigQuery:

Navigate to your Library in Querri
You’ll see all tables from your selected BigQuery dataset(s)
Each table appears as a data source you can work with
Table schemas are automatically indexed for AI-powered querying

Starting Projects from BigQuery Tables

To analyze data from BigQuery:

Go to your Library
Find the BigQuery table you want to analyze
Click to Create Project from that table
Start asking questions in natural language - Querri writes the SQL for you

Examples of what you can ask:

“Show me the top 10 products by revenue in Q4”
“Calculate monthly revenue growth”
“What’s the user retention rate by cohort?”
“Compare this month’s metrics to last month”
“Analyze click patterns from the events table”

BigQuery-Specific Features

Querri automatically leverages BigQuery’s advanced capabilities:

Nested and repeated fields: Ask about nested data naturally
Window functions: Complex analytics are handled automatically
Array operations: Unnesting and array aggregations work seamlessly
Partition pruning: Date filters automatically use partitions for better performance

Querri handles all the SQL query writing automatically, including BigQuery-specific syntax for nested data, arrays, and advanced analytics.

Best Practices

Query Performance

Use date filters: Always filter by date when possible to reduce data scanned
- “Show sales from the last month” (good)
- “Show all sales ever” (expensive)
Select specific columns: Avoid SELECT * on wide tables
Leverage partitions: Query specific date ranges to use partition pruning
Use clustering: Filter on clustered columns for better performance

Cost Management

BigQuery charges based on data processed:

Partition pruning: Query only the partitions you need
Materialized views: Ask about pre-aggregated data when available
Table size awareness: Check table sizes before running large queries
Limit result sets: Use LIMIT for exploratory queries

Example cost-conscious queries:

"Show sample 1000 rows from the events table"
"What's the size of the users table?"
"Count rows in yesterday's partition only"

Security

Read-only access: Querri only requests data viewing permissions
Project-level isolation: Each connector accesses only its specified project
Audit logs: Review BigQuery audit logs in Google Cloud Console
IP whitelisting: Configure VPC firewall rules to allow only Querri’s IP (18.189.33.77)

Data Organization

Descriptive naming: Use clear table and column names
Documentation: Document table schemas and relationships
Consistent types: Maintain consistent data types across related tables
Regular cleanup: Archive or delete unused tables

Troubleshooting

Frequent Reauthentication Prompts

Problem: Asked to sign in repeatedly every 16-24 hours.

Solution:

This is a Google Workspace session control policy issue
See the complete guide in OAuth Authentication & Troubleshooting
Workspace administrators can mark the app as “Trusted” and enable “Exempt trusted apps”
Personal Gmail accounts don’t have this issue

Cannot Connect to BigQuery

Problem: OAuth authorization fails or connection times out.

Solution:

Ensure BigQuery API is enabled in your Google Cloud project
Verify you have the necessary permissions (BigQuery Data Viewer role)
Check if organizational policies restrict OAuth connections
Try signing out of Google and reconnecting
See OAuth Authentication & Troubleshooting for detailed OAuth issues

”Insufficient Permissions” Error

Problem: Connected successfully but cannot query tables.

Solution:

Verify you have BigQuery Data Viewer role on the dataset
Check if table-level permissions are required
Ensure your Google account has access to the selected project
Contact your Google Cloud administrator if using a corporate account

Queries Are Slow

Problem: BigQuery queries take a long time to complete.

Solution:

Add date filters to reduce data scanned
Use partitioned and clustered columns in filters
Check table size (large tables take longer)
Avoid scanning entire tables without filters
Consider creating materialized views for repeated queries

”Quota Exceeded” Error

Problem: Hit BigQuery quota limits.

Solution:

BigQuery has per-project quotas for concurrent queries
Wait a few minutes and try again
Reduce query frequency or complexity
Check quota usage in Google Cloud Console
Consider increasing quotas for your project

Table Not Found

Problem: Query references a table that doesn’t exist.

Solution:

Verify the table name and dataset are correct
Check if the table exists in the selected project
Ensure you have permission to access the table
Confirm the table hasn’t been deleted or moved

Sync Scheduling

BigQuery data can be kept up to date with scheduled syncs. Go to Settings → Connectors, select your BigQuery connector, and open the Schedule tab.

Full Sync

A full sync re-reads all selected tables from your BigQuery dataset. Use this as a periodic baseline.

Incremental Sync

Incremental sync fetches only rows that have changed since the last sync. Like other database connectors, BigQuery requires you to specify the cursor column — typically a TIMESTAMP, DATETIME, or INT64 column.

Good cursor columns for BigQuery:

_PARTITIONTIME — built-in partition timestamp for partitioned tables
updated_at / modified_at — application-managed timestamp columns
event_timestamp — common in event/analytics tables

Recommended Schedule

Schedule	Type	Cron	Purpose
Frequent	Incremental	`0 /4 * *` (every 4 hours)	Fresh data for growing tables
Weekly	Full	`0 5 * * 0` (Sunday 5 AM)	Catches schema changes and ensures accuracy

See the Sync Scheduling guide for full setup instructions.

Advanced Features

Multiple BigQuery Projects

Connect to multiple Google Cloud projects:

Add a new BigQuery connector instance
Authenticate with the same or different Google account
Select a different project
Give it a descriptive name

Example:

BigQuery - Analytics Project
BigQuery - Marketing Data
BigQuery - Production Logs

Then reference them in queries:

"Compare revenue in Analytics Project with costs in Marketing Data"

Scheduled Queries

For complex recurring analytics:

Set up scheduled queries in BigQuery
Query the results table in Querri
Lower cost and faster response times

Cross-Project Queries

If you have permission, you can query across projects:

Reference tables using full project.dataset.table notation
Ensure your service account has cross-project access
Ask questions that span multiple projects

Data Export and Visualization

Exporting Results

After running BigQuery queries through Querri:

Download results as CSV, Excel, or JSON
Export to Google Sheets for sharing
Save to your connected Google Drive

Visualization

Query results can be visualized:

Ask for charts and graphs
Export to visualization tools
Create dashboards from query results

BigQuery Costs

Be aware of BigQuery pricing:

Query costs:

Charged per TB of data scanned
First 1 TB per month is free
Partition and cluster your tables to reduce costs

Storage costs:

Active storage: $0.02 per GB/month
Long-term storage: $0.01 per GB/month (90+ days untouched)

Best practices to minimize costs:

Use date filters to scan less data
Query clustered columns
Use materialized views for repeated aggregations
Limit exploratory queries to samples

Next Steps

Connecting Databases - Learn about other database connectors
Managing Connections - Edit and manage BigQuery connections
Data Cleaning - Clean BigQuery query results

Additional Resources

Google BigQuery documentation: cloud.google.com/bigquery/docs
BigQuery pricing: cloud.google.com/bigquery/pricing
BigQuery best practices: cloud.google.com/bigquery/docs/best-practices

Disconnecting BigQuery

To revoke Querri’s access:

In Querri:

Go to Settings → Connectors
Find your BigQuery connection
Click Disconnect

In Google:

Go to myaccount.google.com/permissions
Find Querri in your connected apps
Click Remove Access

This immediately revokes API access and removes stored OAuth tokens.