Data credentials

Control access to your data.

Credentials determine who can see the data provided by a data source. The 3 types of data credentials are:

Owner's credentials let other users access the data using the credential owner's authorization.
Viewer's credentials rely on each individual report viewer's credentials to access the data.
Service account credentials rely on a special type of Google account representing a non-human user that can be authenticated and authorized to access data.

In this article:

Set credentials for a data source
Types of credentials
Update credentials
Revoke credentials
Related resources

Set credentials for a data source

Edit the data source.
At the top, click the current data credentials
Select the new credential type.
To become the new credential owner, click Make me the owner.

Types of credentials

Owner's credentials

Select this option if you want to let other people view or create reports that use this data without requiring them to have their own access to the data set. Owner's credentials uses the credentials of a specific person to authorize access to the data set. By default, you are the credential owner if you created the data source, but other editors of the data source can become the credential owner.

Using the owner's credentials option does not grant other people the right to access the data set directly. The owner's credentials are never displayed or transmitted "in the clear."

Example

You've created a Google Analytics data source that connects to your company's All Website Traffic view. You selected owner's credentials in the data source Configuration tab. You've shared this data source with Nikhil and Betsy. Nikhil has his own Google Analytics login and permission to access the All Website Traffic view. Betsy does not have access to this view. However, both Nikhil and Betsy can view reports based on this data source, because it uses your credentials, not theirs.

Viewer's credentials

This option requires each user of the data source (or reports that are built using the data source) to provide their own credentials to access the data set. If they do not have access to the data set, they won't be able view the data in reports, or edit the data source fields.

Example

It's the same scenario as above, only this time you've selected the viewer's credential option. You've shared a report built using this data source with the same people, but only Nikhil, who has his own credentials to the All Website Traffic view in Google Analytics will be able to see the data. When Betsy views the report, she will not see this data.

Service account credentials

Instead of delegating access using owner's credentials, or requiring individual report viewers to have access to the data using viewer's credentials, Looker Studio can use a service account to authenticate and get authorization to access your data.

Note:

Service account credentials are only available for Google Workplace or Cloud Identity managed organizations.
Service account credentials are currently available only for BigQuery data sources
Service accounts must be set up by a Google Workplace or Cloud Identity administrator. If that's you, learn how to set up a service account.

If a service account has already been set up, you can use it to connect a data source to BigQuery data by providing the service account's email address in the data source credentials dialog.

Create or edit a BigQuery data source.
In the toolbar, click Data Credentials.
Select Service Account Credentials.
Enter your Service account email address in the box..
Click Update.

How to find your service account

The simplest way to know which service account to use is to ask your Google Cloud administrator. Your organization may have multiple service accounts set up, so it's important to use the correct one.

If you have access to the Cloud Console, you can use it to list the available service accounts:

Use Cloud console

Navigate to the Google Cloud Platform > IAM & Admin > Service accounts page.
Select a project if necessary.
In the Service accounts for project page, locate the service account that Looker Studio will use to access your BigQuery data..
Copy the email address for that account.

Use Cloud shell

Open the Cloud shell.
Select a project if necessary.
To list the service accounts to which you have access, run the gcloud iam service-accounts list command.

Example:

gcloud iam service-accounts list

Getting an error?

If you see an error in the credentials dialog or in your reports while trying to use a service account, it's most likely due to an incomplete or incorrect service account set up. Try finding the solution here.

Update credentials

Editors of a data source can update its credentials:

Editors can change the type of credentials used by the data source.
Editors can become the new credential owner.

Changing data source credentials may cause people who don't have access to the underlying data set to see errors in reports.

Revoke your data credentials

Data sources that use your credentials continue to retrieve data, even if you can no longer edit the data source. Revoking your credentials stops the data source from accessing the data "as you."

For example, if you create a data source for your company and then leave that company, you can stop that data source from retrieving data. You can do this for an individual data source, or you can revoke your credentials from all data sources to which you no longer have access.

Revoke your credentials from a single data source

Sign in to Looker Studio.
At the top, select Data Sources.
Browse or search for the file you want to stop sharing, then on the right, click More .
Click Revoke data source.

Revoke your credentials from all data sources you no longer own

Sign in to Looker Studio.
At the top right, click Settings .
Select Revoke Data Source.
A list of all data sources you created but no longer own appears.
Click Revoke all.

Related resources

Was this helpful?

How can we improve it?