Credentials determine who can see the data that is provided by a data source. Looker Studio uses three types of data credentials:
- Owner's Credentials let other users access the data by using the credential owner's authorization.
- Viewer's Credentials rely on each individual report viewer's credentials to access the data.
- Service Account Credentials rely on a special type of Google account that represents a non-human user, which can be authenticated and authorized to access data.
Set credentials for a data source
- Edit the data source.
- At the top of the screen, click Data credentials.
- Select the new credential type.
- To become the new credential owner, click Make me the owner.
Types of credentials
Owner's Credentials
Select this option if you want to let other people view or create reports that use this data without requiring them to have their own access to the data set. Owner's Credentials uses the credentials of a specific person to authorize access to the data set. By default, you are the credential owner if you created the data source, but another editor of the data source can become the credential owner.
Using the Owner's Credentials option does not grant other people the right to access the dataset directly. The Owner's Credentials are never displayed or transmitted "in the clear."
Example
You've created a Google Analytics data source that connects to your company's All Website Traffic view. You selected Owner's Credentials in the data source Configuration tab. You've shared this data source with Nikhil and Betsy. Nikhil has his own Google Analytics login and permission to access the All Website Traffic view. Betsy does not have access to this view. However, both Nikhil and Betsy can view reports based on this data source, because it uses your credentials, not theirs.
Viewer's Credentials
This option requires each user of the data source (or reports that are built using the data source) to provide their own credentials to access the dataset. If they do not have access to the dataset, they won't be able to view the data in reports or to edit the data source fields.
Example
It's the same scenario as described previously in the "Owner's Credentials" section, only this time you've selected the Viewer's Credentials option. You've shared a report that was built using this data source with the same people, but only Nikhil, who has his own credentials to the All Website Traffic view in Google Analytics, will be able to see the data. When Betsy views the report, she will not see this data.
Service Account Credentials
Instead of delegating access using the Owner's Credentials option, or requiring individual report viewers to have access to the data using the Viewer's Credentials option, Looker Studio can use a service account to authenticate and get authorization to access your data.
- The Service Account Credentials option is available only for Google Workplace or Cloud Identity managed organizations.
- Service Account Credentials are currently available only for BigQuery data sources.
- Service accounts must be set up by a Google Workplace or Cloud Identity administrator. If that's you, learn how to set up a service account.
If a service account has already been set up, you can use it to connect a data source to BigQuery data by providing the service account's email address in the data source credentials dialog. Follow these steps:
- Create or edit a BigQuery data source.
- In the toolbar, click Data Credentials.
- Select Service Account Credentials.
- Enter your Service account email address in the box.
- Click Update.
How to find your service account
The simplest way to know which service account to use is to ask your Google Cloud administrator. Your organization may have multiple service accounts set up, so it's important to use the correct one.
If you have access to the Cloud console, you can use it to list the available service accounts in one of two ways:
Use Cloud console
- Navigate to the Google Cloud Platform > IAM & Admin > Service accounts page.
- Select a project, if necessary.
- In the Service accounts for project page, locate the service account that Looker Studio will use to access your BigQuery data.
- Copy the email address for that account.
Use Cloud shell
- Open the Cloud shell.
- Select a project, if necessary.
- To list the service accounts to which you have access, run the gcloud iam service-accounts list command.
Example:
gcloud iam service-accounts list
Getting an error?
If you see an error in the credentials dialog or in your reports while you're trying to use a service account, it's most likely caused by an incomplete or incorrect service account setup. See Set up a Google Cloud service account for Looker Studio for possible solutions.
Update credentials
Editors of a data source can update its credentials:
- Editors can change the type of credentials that are used by the data source.
- Editors can become the new credential owner.
Revoke your data credentials
Data sources that use your credentials continue to retrieve data even if you can no longer edit the data source. Revoking your credentials stops the data source from accessing the data "as you."
For example, if you create a data source for your company and then leave that company, you can stop that data source from retrieving data. You can do this for an individual data source, or you can revoke your credentials from all data sources to which you no longer have access.
Revoke your credentials from a single data source
- Sign in to Looker Studio.
- At the top, select Data Sources.
- Browse or search for the file that you want to stop sharing; then, on the right, click More
.
- Click Revoke data source.
.Revoke your credentials from all data that sources you no longer own
- Sign in to Looker Studio.
- At the top right, click Settings
.
- Select Revoke Data Source.
- A list of all data sources that you created but no longer own appears.
- Click Revoke all.
.