> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect to Google BigLake using application default credentials

> Use a Google runtime identity to authenticate to the BigLake Iceberg REST API.

How-to guideApplies to: Unified engine deployments

Use a Google runtime identity to authenticate to the BigLake Iceberg REST API.

## Before you start

Use an existing catalog with at least one readable Iceberg table. The engine and
workers must reach the catalog and its table storage. Have the remote identity
and permissions ready before creating the Unified registration. Replace the
namespace and table with one you know has data.

Application default credentials must be available where the credential service
runs. Grant the identity the required BigLake, billing-project, and
table-storage access. The server must provide supported storage access for the
selected table.

## Values to collect

* BigLake REST URI, warehouse, billing project ID, namespace, and table.

## Run the SQL

Replace every `<placeholder>` before running. Use unused names for the resources
below. Run the statements in order in Workbench.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE CREDENTIAL recipe_biglake_auth USING gcp
OPTIONS (
  'authentication' = 'application_default',
  'scopes' = 'https://www.googleapis.com/auth/cloud-platform'
);

CREATE CATALOG recipe_biglake USING `iceberg-rest`
OPTIONS (
  'catalog.type' = 'biglake',
  'uri' = '<biglake-rest-uri>',
  'warehouse' = '<warehouse>',
  'auth.type' = 'bearer',
  'header.x-goog-user-project' = '<billing-project-id>',
  'scope' = 'https://www.googleapis.com/auth/cloud-platform',
  'header.x-iceberg-access-delegation' = 'vended-credentials'
)
CREDENTIALS ('auth' = 'recipe_biglake_auth');

SELECT *
FROM recipe_biglake.`<namespace>`.`<table>`
LIMIT 5;
```

## Check the result

The SELECT should return up to five rows from the chosen table. Use a nonempty
table for this check. This verifies both metadata and table-file access;
creating the registration alone does not verify either.

The billing project is a catalog request setting. It does not replace the Google
identity or grant that identity permissions.

## Clean up

This removes only the Unified registrations. It leaves the remote catalog and
its tables in place.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP CATALOG recipe_biglake;
DROP CREDENTIAL recipe_biglake_auth;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.