Task
Version · 6.0
Create

Connect Liquibase with Google BigQuery

Last updated: September 29, 2026

Google BigQuery is a fully managed analytics data warehouse.

The Liquibase Secure Google BigQuery extension enables efficient version control and database change management for BigQuery schema and application data. This extension gives Google BigQuery users a smooth, streamlined approach to database change management and deployment, fitting effortlessly into Agile development and CI/CD automation practices.

Read more about Database DevOps with Liquibase and BigQuery.

Verified database versions 2.13.6+

Warning: Liquibase versions 4.24.0, 4.25.0, and 4.25.1 transformed table names in BigQuery to lowercase which caused Liquibase to not be able to read its own DATABASECHANGELOG table, so it would create a new one and redeploy all previously deployed changesets. This issue is fixed in Liquibase 4.26.0 and later releases.

Before you begin

Install Liquibase
Ensure you have Java installed. Liquibase requires Java to run. If you used the Liquibase Installer, Java is included automatically. Otherwise, you must install Java manually.

Procedure

(Maven users only) Configure Maven

If you're running Liquibase using the Maven plugin using mvn liquibase:update installing the extension with Maven ensures the right files are available and everything works together automatically. You can manage these extensions by adding them as dependencies in your project’s pom.xml file. When configured this way, Maven automatically downloads the specified JAR files from Maven Central during the build process.

Configure your connection

1. Ensure your BigQuery database is configured. See BigQuery Quickstarts for more information.

2. Specify the database URL in the liquibase.properties file (defaults file), along with other properties you want to set a default value for. Liquibase does not parse the URL. You can either specify the full database connection string or specify the URL using your database's standard connection format:

Before you run the example, be sure to:

Update your_host with your BigQuery host.
Update your_port with your BigQuery port number.
Update your_project_id with your BigQuery project ID. This is the project the driver queries by default and the one that is billed for queries run using the Data Source Name. See BigQuery: Projects for more information.
Update your_dataset_id with your default BigQuery dataset ID. This is the dataset the driver queries by default. Liquibase requires this parameter to know where to create its tracking tables. It also allows you to use unqualified table names, which the driver treats as part of the default dataset. See BigQuery: Introduction to datasets.
Update your_oauth_type with your OAuth type (0, 1, 2, or 3). This determines how the driver obtains or provides credentials for OAuth 2.0 authentication.
Update any additional properties (your_property1=your_value1, etc.) as needed for your configuration.

url: jdbc:bigquery://your_host:your_port;ProjectId=your_project_id;DefaultDataset=your_dataset_id;OAuthType=your_oauth_type;your_property1=your_value1;your_property2=your_value2;...

Note: For detailed information on JDBC connections for BigQuery, including OAuthType information, see here: Simba Google BigQuery JDBC Connector Install and Configuration Guide_1.5.0.1001.pdf.

Google Services. Requires the options OAuthServiceAcctEmail (service principal identifier) and OAuthPvtKeyPath (private key) in your Liquibase url property. For example:

url: jdbc:bigquery://https://googleapis.com/bigquery/v2:443; ProjectId=myProject; DefaultDataset=myDataset; OAuthType=0; OAuthServiceAcctEmail=lbtest@bq123.iam.gserviceaccount.com; OAuthPvtKeyPath=C:\path\serviceKey.p12;

To obtain values for OAuthServiceAcctEmail and OAuthPvtKeyPath, follow these steps:

Log into Google Cloud Console with an administrator ID.
Select the Navigation Menu in the upper left and go to IAM & Admin. All principals will be shown by default.
Apply a filter of "BigQuery" to display only the service principals related to BigQuery. Note the value in the Principal column for the ID that Liquibase will use — for example: lbtest@bq123.iam.gserviceaccount.com. Use this service account email address as the value of the OAuthServiceAcctEmail property.
To get the private key for the service account: In the left navigation menu, select Service Accounts. From the resulting list, select the same service account email from the previous step. The details page will open.
Select the KEYS tab. Any existing keys will be displayed at the bottom.
Click ADD KEY > Create new key.
Choose P12 as the key type, then click CREATE. The key will be downloaded automatically. A prompt will also appear requesting a Private key password.
Enter and save the private key password — you’ll need this later.
Save the downloaded private key file and refer to its local path in the OAuthPvtKeyPath property of your JDBC URL.

Google User Account authentication. Requires your user account credentials. For example:

url: jdbc:bigquery://https://googleapis.com/bigquery/v2:443; ProjectId=myProject; OAuthType=1;

Google Authorization Server Access Token. Requires the options OAuthAccessToken, OAuthRefreshToken, OAuthClientId, and OAuthClientSecret in your Liquibase url property. For example:

url: jdbc:bigquery://https://googleapis.com/bigquery/v2:443; ProjectId=myProject; DefaultDataset=myDataset; OAuthType=2; OAuthAccessToken=a25c7cfd36214f94a79d; OAuthRefreshToken=2kl0Qvuw9qt4abia54qga5t97; OAuthClientId=22n6627g243322f7; OAuthClientSecret=cDE+F2g3Hcjk4K5lazM;

Application Default Credentials. For example:

url: jdbc:bigquery://https://googleapis.com/bigquery/v2:443; ProjectId=myProject; DefaultDataset=myDataset; OAuthType=3;

Google Services. Requires the options OAuthServiceAcctEmail (service principal identifier) and OAuthPvtKeyPath (private key) in your Liquibase url property. For example:

To obtain values for OAuthServiceAcctEmail and OAuthPvtKeyPath, follow these steps:

Log into Google Cloud Console with an administrator ID.
Select the Navigation Menu in the upper left and go to IAM & Admin. All principals will be shown by default.
Apply a filter of "BigQuery" to display only the service principals related to BigQuery. Note the value in the Principal column for the ID that Liquibase will use — for example: lbtest@bq123.iam.gserviceaccount.com. Use this service account email address as the value of the OAuthServiceAcctEmail property.
To get the private key for the service account: In the left navigation menu, select Service Accounts. From the resulting list, select the same service account email from the previous step. The details page will open.
Select the KEYS tab. Any existing keys will be displayed at the bottom.
Click ADD KEY > Create new key.
Choose P12 as the key type, then click CREATE. The key will be downloaded automatically. A prompt will also appear requesting a Private key password.
Enter and save the private key password — you’ll need this later.
Save the downloaded private key file and refer to its local path in the OAuthPvtKeyPath property of your JDBC URL.

Google User Account authentication. Requires your user account credentials. For example:

url: jdbc:bigquery://https://googleapis.com/bigquery/v2:443; ProjectId=myProject; OAuthType=1;

Google Authorization Server Access Token. Requires the options OAuthAccessToken, OAuthRefreshToken, OAuthClientId, and OAuthClientSecret in your Liquibase url property. For example:

Application Default Credentials. For example:

url: jdbc:bigquery://https://googleapis.com/bigquery/v2:443; ProjectId=myProject; DefaultDataset=myDataset; OAuthType=3;

Test connection

1. Create a text file calledchangelog (.sql,.yaml,.json, or.xml) in your project directory and add a changeset.

If you have already created a changelog using theinit projectcommand, you can use that instead of creating a new file. When adding onto an existing changelog, be sure to only add the changeset and not duplicate the changelog header.

--liquibase formatted sql

--changeset your.name:1
CREATE TABLE test_table (test_id INT NOT NULL, test_column INT, PRIMARY KEY (test_id) NOT ENFORCED)

databaseChangeLog:
   - changeSet:
       id: 1
       author: your.name
       changes:
       - createTable:
           tableName: test_table
           columns:
           - column:
               name: test_id
               type: INT
               constraints:
                   primaryKey:  true
                   nullable:  false
           - column:
               name: test_column
               type: INT

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "1",
        "author": "your.name",
        "changes": [
          {
            "createTable": {
              "tableName": "test_table",
              "columns": [
                {
                  "column": {
                    "name": "test_id",
                    "type": "INT",
                    "constraints": {
                      "primaryKey": true,
                      "nullable": false
                    }
                  }
                },
                {
                  "column": {
                    "name": "test_column",
                    "type": "INT"
                  }
                }
              ]
            }
          }
        ]
      }
    }
  ]
}

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
    xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:ext="http://www.liquibase.org/xml/ns/dbchangelog-ext"
    xmlns:secure="http://www.liquibase.org/xml/ns/secure"
    xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/dbchangelog-ext
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-ext.xsd
        http://www.liquibase.org/xml/ns/secure
        http://www.liquibase.org/xml/ns/secure/liquibase-secure-latest.xsd">

    <changeSet id="1" author="your.name">
        <createTable tableName="test_table">
            <column name="test_id" type="int">
                <constraints primaryKey="true" nullable="false" />
            </column>
            <column name="test_column" type="int"/>
        </createTable>
    </changeSet>

</databaseChangeLog>

--liquibase formatted sql

--changeset your.name:1
CREATE TABLE test_table (test_id INT NOT NULL, test_column INT, PRIMARY KEY (test_id) NOT ENFORCED)

databaseChangeLog:
   - changeSet:
       id: 1
       author: your.name
       changes:
       - createTable:
           tableName: test_table
           columns:
           - column:
               name: test_id
               type: INT
               constraints:
                   primaryKey:  true
                   nullable:  false
           - column:
               name: test_column
               type: INT

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "1",
        "author": "your.name",
        "changes": [
          {
            "createTable": {
              "tableName": "test_table",
              "columns": [
                {
                  "column": {
                    "name": "test_id",
                    "type": "INT",
                    "constraints": {
                      "primaryKey": true,
                      "nullable": false
                    }
                  }
                },
                {
                  "column": {
                    "name": "test_column",
                    "type": "INT"
                  }
                }
              ]
            }
          }
        ]
      }
    }
  ]
}

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
    xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:ext="http://www.liquibase.org/xml/ns/dbchangelog-ext"
    xmlns:secure="http://www.liquibase.org/xml/ns/secure"
    xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/dbchangelog-ext
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-ext.xsd
        http://www.liquibase.org/xml/ns/secure
        http://www.liquibase.org/xml/ns/secure/liquibase-secure-latest.xsd">

    <changeSet id="1" author="your.name">
        <createTable tableName="test_table">
            <column name="test_id" type="int">
                <constraints primaryKey="true" nullable="false" />
            </column>
            <column name="test_column" type="int"/>
        </createTable>
    </changeSet>

</databaseChangeLog>

2. Navigate to your project folder in the CLI and run the Liquibasestatuscommand to see whether the connection is successful:

liquibase status --username=test --password=test --changelog-file=<changelog.xml>

Note:You can specify arguments in the CLI or keep them in the Liquibase properties file.

If your connection is successful, you'll see a message like this:

4 changesets have not been applied to <your_connection_url> Liquibase command 'status' was executed successfully.

3. Inspect the deployment SQL with theupdate-sqlcommand:

liquibase update-sql --changelog-file=<changelog.xml>

If the SQL that Liquibase generates isn't what you expect, you should review your changelog file and make any necessary adjustments.

4. Then execute these changes to your database with theupdatecommand:

liquibase update --changelog-file=<changelog.xml>

If yourupdateis successful, Liquibase runs each changeset and displays a summary message ending with:

Liquibase: Update has been successful. Liquibase command 'update' was executed successfully.

5. From a database UI tool, ensure that your database contains thetest_tableobject you added along with the DATABASECHANGELOG table and DATABASECHANGELOGLOCK table.

Now you're ready to start deploying database changes with Liquibase.

PreviousWhat support does Liquibase have for Google BigQuery?NextUnderstand deployment output for Google BigQuery

Connect Liquibase with Google BigQuery

Before you begin

Procedure

(Maven users only) Configure Maven

Configure your connection

OAuthType0

OAuthType1

OAuthType2

OAuthType3

Test connection

SQL

YAML

JSON

XML

Next steps