# Connect BigQuery to your AI client

> Connect BigQuery to Bonnard through a read-only service account, the first step to querying it from Claude, ChatGPT or another AI client.

Updated: 2026-10-12

To chart BigQuery data in Claude, ChatGPT or another AI client, connect it here, then create an app on it.
Bonnard reads BigQuery through a read-only service account, so your apps query only what you grant.

[Video: Connecting BigQuery: the Data page, the BigQuery form, the key upload, Test & connect, and Connection saved]

## Requirements

- The Admin role in your Bonnard workspace.
- Permission in the Google Cloud project to create service accounts and keys, and to grant IAM roles on the project and its datasets.
- Service account keys allowed in the project. The `iam.disableServiceAccountKeyCreation` organization policy blocks them, and organizations created since May 3, 2024 enforce it by default.

## 1. Create a read-only service account

Bonnard connects as this service account. Agents can query only the tables it can read.

```sh
# A service account for Bonnard
gcloud iam service-accounts create mcp-reader \
  --project=<project_id> --display-name="Bonnard reader"

# Let it read one dataset. Run this once for each dataset apps should query
bq query --use_legacy_sql=false \
  'GRANT `roles/bigquery.dataViewer` ON SCHEMA `<project_id>`.<dataset>
   TO "serviceAccount:mcp-reader@<project_id>.iam.gserviceaccount.com"'

# Let it run queries in the project. This grants no access to data
gcloud projects add-iam-policy-binding <project_id> \
  --member="serviceAccount:mcp-reader@<project_id>.iam.gserviceaccount.com" \
  --role="roles/bigquery.jobUser"

# A JSON key for the connect form
gcloud iam service-accounts keys create mcp-reader-key.json \
  --iam-account=mcp-reader@<project_id>.iam.gserviceaccount.com
```

Replace `<project_id>` and `<dataset>` with your own. Grant datasets you add later the same way.

## 2. Add the connection

1. In the console at `app.bonnard.ai`, select **Data**, then **BigQuery**.
   [Image: The Data page with BigQuery under Databases]
2. Under **How should requests route to BigQuery data?**, choose how each tenant (the customer a caller belongs
   to) is routed, from the routing table below.
3. Enter a **Connection name** and the service account's details from the fields table below.
   [Image: The BigQuery connection form]
4. Select **Test & connect**. Bonnard logs in as the service account and reads the tables it can see.

Table: Routing options

| Option | Use it when |
| --- | --- |
| **No tenancy** | Every caller should see the same data. |
| **Dataset per tenant** | Each tenant has its own dataset and its own service account. |

With **Dataset per tenant**, upload one customer's key, pick their dataset under **Which dataset is this
customer's?**, then confirm the **Layout** step. You map each customer to their dataset later, on the app that serves
them.

Table: BigQuery connection fields

| Field | Enter |
| --- | --- |
| **Connection name** | A name for this database in Bonnard, such as `Production`. |
| **Project ID** | The ID of the project that holds the datasets from step 1, not its name. |
| **Service account JSON** | The key file from step 1. Select **Upload key (.json)**, or paste the file's contents under **or paste JSON**. |

**Connection saved** shows the number of tables discovered.

[Image: Connection saved, with the tables discovered]

## Troubleshooting

- `bigquery discovery covers at most 100 datasets and this service account can see more: scope its IAM to the datasets you mean to expose.`
  The account reads over 100 datasets. Remove any project-wide role, and grant `roles/bigquery.dataViewer` on each dataset instead
  (step 1). Past 2,000 tables, the message names tables instead. The fix is the same.
- `credentials must be valid JSON.` Upload the key file, or paste the whole file.
- `invalid_grant` with `Invalid JWT Signature.` The key is deleted, disabled or expired. Create a
  new key (step 1) and upload it.
- A table is missing. Grant `roles/bigquery.dataViewer` on its dataset. After a minute, select **Re-introspect** on
  the database's **Tables** tab.
- Any other error is BigQuery's own message. Check the field it names, then select **Test & connect** again.

## Charts in your AI client

[Create an app](https://bonnard.ai/docs/apps/create-an-app.md) on this database, so AI clients such as Claude and ChatGPT can query it and draw charts.