如何在后端使用OAuth2令牌通过BigQuery SDK访问用户BigQuery表？

Absolutely! Both the com.google.api.services.bigquery (legacy Google Client Library) and com.google.cloud.bigquery (newer Cloud Client Library) fully support authenticating using a user's OAuth2 access token—you don't have to rely on p12/PEM service account keys for this use case. Here's how to implement it for each library:

1. 使用 com.google.api.services.bigquery（老客户端库） #

You'll use GoogleCredential to wrap your access token, then pass it to the BigQuery builder:

import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.bigquery.BigQuery;

// 替换成你获取到的用户access token
String userAccessToken = "YOUR_USER_ACCESS_TOKEN";

// 构建凭证并设置access token
GoogleCredential credential = new GoogleCredential.Builder()
    .setTransport(new NetHttpTransport())
    .setJsonFactory(JacksonFactory.getDefaultInstance())
    .build()
    .setAccessToken(userAccessToken);

// 创建BigQuery客户端实例
BigQuery bigQuery = new BigQuery.Builder(credential.getTransport(), credential.getJsonFactory(), credential)
    .setApplicationName("Your-App-Name")
    .build();

2. 使用 com.google.cloud.bigquery（新Cloud Client Library） #

This library uses Google's modern auth libraries, so you'll create an OAuth2Credentials object from your access token:

import com.google.cloud.bigquery.BigQuery;
import com.google.cloud.bigquery.BigQueryOptions;
import com.google.auth.oauth2.AccessToken;
import com.google.auth.oauth2.OAuth2Credentials;
import java.util.Date;

// 替换成你的用户access token和实际过期时间（从OAuth响应中获取）
String accessTokenValue = "YOUR_USER_ACCESS_TOKEN";
Date expirationTime = new Date(System.currentTimeMillis() + 3600 * 1000); // 示例：1小时后过期

// 构建AccessToken和凭证
AccessToken accessToken = new AccessToken(accessTokenValue, expirationTime);
OAuth2Credentials credentials = OAuth2Credentials.newBuilder()
    .setAccessToken(accessToken)
    .build();

// 创建BigQuery客户端
BigQuery bigQuery = BigQueryOptions.newBuilder()
    .setCredentials(credentials)
    .setProjectId("USER_PROJECT_ID") // 必须指定用户的项目ID
    .build()
    .getService();

重要注意事项 #

• Token Expiry: OAuth2 access tokens are short-lived (typically 1 hour). You'll need to handle token refresh logic using a refresh token (if you obtained one during the OAuth flow) to avoid authentication errors.
• Scopes: Make sure your OAuth request included the necessary BigQuery scopes (e.g., full access with https://www.googleapis.com/auth/bigquery, or read-only with https://www.googleapis.com/auth/bigquery.readonly) to perform the actions your app needs.
• Dependency Setup: For the newer library, ensure you have the correct Maven/Gradle dependency for google-cloud-bigquery in your project.

内容的提问来源于stack exchange，提问作者Evgeny Makarov