BigQuery OAuth - Paradime

With BigQuery OAuth, users authorize their Code IDE credentials through Single Sign-On (SSO) via BigQuery rather than uploading a service account key to Paradime. Set Target to match the environment you are configuring (dev).

Available in: Code IDE only. The Bolt and Agent environments run non-interactively, so they use a dedicated service account with service account JSON instead.

If BigQuery is set up with SSO through a third-party identity provider, developers can use this method to log into BigQuery and authorize their dbt™ Code IDE credentials without any additional setup.

Create a BigQuery OAuth 2.0 client ID and secret

To enable OAuth, create a Client ID and Secret to authenticate with GCP and manage the OAuth connection between Paradime and BigQuery. In the BigQuery Console, navigate to APIs & Services and select Credentials. If you have not already, set up an OAuth consent screen, then click + Create Credentials in the top navigation bar and select OAuth client ID from the menu.

Required configurations

Use the configurations below to set up the BigQuery OAuth app, then click Create. You will generate the Client ID and Secret required to connect Paradime to your BigQuery account.

Config	Value
APPLICATION TYPE	Web application
NAME	paradime
AUTHORIZED JAVASCRIPT ORIGINS	Required. Use the correct domain for your region (check your selected region during onboarding in Workspace Settings > Workspace Management): 🇪🇺 eu-west-2 (Europe - London): `https://api.paradime.io` 🇪🇺 eu-west-1 (Europe - Ireland): `https://eu-w1-api.paradime.io` 🇪🇺 eu-central-1 (Europe - Frankfurt): `https://eu-c1-api.paradime.io` 🇺🇸 us-east-1 (US East - N. Virginia): `https://api.us.paradime.io`
AUTHORIZED REDIRECT URIs	Required. Use the correct domain for your region (check your selected region during onboarding in Workspace Settings > Workspace Management): 🇪🇺 eu-west-2 (Europe - London): `https://api.paradime.io/control-plane/bigquery/redirect` 🇪🇺 eu-west-1 (Europe - Ireland): `https://eu-w1-api.paradime.io/control-plane/bigquery/redirect` 🇪🇺 eu-central-1 (Europe - Frankfurt): `https://eu-c1-api.paradime.io/control-plane/bigquery/redirect` 🇺🇸 us-east-1 (US East - N. Virginia): `https://api.us.paradime.io/control-plane/bigquery/redirect`

OAuth 2.0 scopes for Google APIs

The Paradime BigQuery OAuth app requests the following scopes. Each user approves these scopes when connecting.

https://www.googleapis.com/auth/bigquery
https://www.googleapis.com/auth/drive.readonly
https://www.googleapis.com/auth/devstorage.read_only

Field details

Field access levels apply only to the Code IDE environment: an Admin sets workspace-level fields, and each developer sets their own user-level fields. In the Bolt and Agent environments, an Admin sets all fields.

Field	Description	Example
Profile Name	The profile name set in your `dbt_project.yaml`. See more here.	`dbt-bigquery`
Target	The target name used to identify the connection. See more here.	`dev`
Dataset Location	The location of BigQuery datasets, configured using the location configuration in a BigQuery profile. Location can be either a multi-regional location (e.g. `EU`, `US`), or a regional location (e.g. `europe-west2`). See more here.	`US`
Project ID	The unique identifier of your BigQuery project. See more here.	`dbt-demo-project`
Client ID	The Client ID generated when setting up the OAuth credentials.	`xyz123.apps.googleusercontent.com`
Client Secret	The Client Secret generated when setting up the OAuth credentials.	`GOCSPX-hPfGJe7sd238772BLBA2Bi0ds`
Execution Project ID (Optional)	You can specify an Execution Project ID to bill for query execution, instead of the project where you materialize your resources. See more here.	(Optional) `analytics-global-project`
Dataset	The default dataset used to build dbt™ objects at runtime.	`dbt_john`
Threads	The number of threads used in this connection. See more here.	`8`

​Create a BigQuery OAuth 2.0 client ID and secret

​Required configurations

​OAuth 2.0 scopes for Google APIs

​Field details

Create a BigQuery OAuth 2.0 client ID and secret

Required configurations

OAuth 2.0 scopes for Google APIs

Field details