> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wisdom.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Set up a GCP service account for WisdomAI
WisdomAI uses a Google Cloud Platform (GCP) service account to authenticate with BigQuery for background operations such as metadata crawling and data discovery. This guide walks you through creating the service account, assigning the required IAM roles, and generating the JSON key that WisdomAI needs to connect.
## Prerequisites
* An active Google Cloud project
* The BigQuery API enabled in that project
* Permission to create service accounts and assign IAM roles in your GCP project
## Create the service account
A service account is a Google account that an application uses to make authorized API calls on its own behalf.
1. Open the GCP Console and go to **IAM & Admin** > **Service Accounts**.
2. Click **+ CREATE SERVICE ACCOUNT**.
3. Enter a descriptive **Service account name**, for example `Wisdom-bigquery`. The **Service account ID** is generated automatically from the name.
4. Optionally, add a **Service account description** such as `Service account for WisdomAI BigQuery connectivity`.
5. Click **CREATE AND CONTINUE**.
## Assign IAM roles
WisdomAI needs three roles to read metadata, run queries, and stream results efficiently from BigQuery:
* **BigQuery Data Viewer**: view BigQuery data and metadata
* **BigQuery Job User**: run BigQuery jobs, including queries
* **BigQuery Read Session User**: retrieve data efficiently through the BigQuery Storage API
Assign these roles at the project level for broad access:
1. On the **Grant this service account access to project** step, open the **Select a role** dropdown.
2. Add **BigQuery Data Viewer**, **BigQuery Job User**, and **BigQuery Read Session User**.
3. Click **DONE**.
### Restrict access to specific datasets
If you want WisdomAI to access only certain datasets in your project, grant data roles at the dataset level instead of the project level.
1. Open BigQuery in the GCP Console and select the dataset you want to share.
2. Click **SHARE DATASET**.
3. In the **Add principals** field, enter the email address of the service account.
4. Assign **BigQuery Data Viewer** and **BigQuery Read Session User** to the service account for this dataset.
5. Repeat for every dataset WisdomAI needs to access.
6. Assign **BigQuery Job User** once at the project level. This role cannot be granted at the dataset level.
## Generate a JSON key
WisdomAI authenticates with BigQuery using a JSON key file associated with the service account.
1. Go back to **IAM & Admin** > **Service Accounts** and click the service account you created.
2. Open the **KEYS** tab.
3. Click **ADD KEY** > **Create new key**.
4. Select **JSON** as the key type and click **CREATE**.
The key file downloads to your computer.
The JSON key file contains sensitive credentials. Treat it like a password: store it in a secrets manager or secure file-sharing tool, and never send it over unencrypted email or chat.
## Next steps
Use the service account to create a BigQuery connection in WisdomAI.
Connect to Snowflake directly or via a proxy using key-pair authentication.