BigQuery: Rotate a Service Account Key and Export Field Codes

Overview

This article covers two related administration tools: changing the service account file used by an existing BigQuery dataset connection, and exporting a form’s field identifiers, field types, titles, and internal short codes to CSV.

Changing the service account supports credential rotation without recreating the GW Apps dataset connection. The field export provides a practical reference for BigQuery schemas, APIs, integrations, queries, and technical data dictionaries.

Availability: The BigQuery Change Service Account control is enabled on demand for each client. If the control is not visible, contact GW Apps Support or your GW Apps account contact to request activation. Field export is a separate form-level function and does not require the form to be connected to BigQuery.

Warning: A Google service account JSON file contains private credentials. Store and transfer it using an approved secret-handling process. Never paste its contents into screenshots, support tickets, email, or this article.

Before You Begin

To change a BigQuery service account, make sure you have:

• The Change Service Account feature enabled for your client platform
• Platform Administrator access to BigQuery Datasets
• An existing BigQuery dataset connection that uses an external service account
• The replacement Google service account JSON file
• A service account with access to the connected Google Cloud project and dataset
• At least the BigQuery Data Editor and BigQuery Metadata Viewer roles shown in the dataset setup screen

To export form field information, you need App Designer access to the application and the form you want to document.

Change the Service Account for an Existing Dataset

1. Create or obtain the replacement service account JSON file according to your organization’s Google Cloud key-rotation process. Keep the existing credential active until the replacement is tested.
2. In GW Apps, open Platform Admin.
3. Select BigQuery Datasets from the administration menu.
4. Locate the existing dataset connection, open its three-dot menu, and select Edit.
5. In BigQuery Dataset Setup, locate Change Service Account.
6. Select Upload Service Account File and choose the replacement JSON file.
7. Confirm that the replacement filename appears beside the upload control. Do not expose the JSON contents.
8. Select Save.

Important: Upload the replacement file on the existing dataset connection. You do not need to create a new GW Apps BigQuery dataset solely to rotate the credential.

Verify the New Credential

1. Create a safe test record in a form that writes to the affected dataset.
2. Confirm that the expected record or event reaches BigQuery.
3. Update the test record and confirm that the expected update reaches BigQuery.
4. Check Google Cloud and any available GW Apps error information for authorization or write failures.
5. After the replacement has passed the required tests, revoke the previous Google Cloud key according to your organization’s rotation policy.
6. Repeat a create or update test after revocation to confirm that GW Apps is using the new credential.

Do not revoke the previous key before testing the replacement. If the new file is invalid or lacks the required permissions, keeping the previous key active provides a safer recovery path.

Export Field Titles and Internal Codes

The export is generated from an individual form. It does not require opening the form’s BigQuery configuration.

1. Open the application in Edit mode.
2. Under Forms, select the form whose field information you want to export.
3. Select More in the upper-right corner of the form page.
4. Select Export Fields to CSV.

5. Open the downloaded CSV file. For the Asset form shown in the recording, the downloaded filename is Asset-fields.csv.
6. Use Field Name as the field’s displayed title and Short Code as its internal field-code reference.

CSV Column Reference

Field	Description
Field ID	The platform-generated identifier for the field, such as text155380772754212.
Field Type	The form-field type, such as text, list, date, textarea, filePicker, directoryLookup, or dynamicTable.
Field Name	The human-readable field title displayed to app designers and users, such as Asset Name.
Short Code	The field’s internal short code, such as asset_name1. Use this value when a technical reference requires the internal field code.

Best practice: Save the form before exporting, confirm that you exported from the intended application and form, and re-export the CSV after fields or field titles change. Treat the CSV as a point-in-time mapping reference.

Security and Rotation Checklist

• Confirm that the on-demand Change Service Account feature is enabled before scheduling the rotation.
• Keep the prior key active until end-to-end testing succeeds.
• Never expose the private key or JSON contents in documentation, email, chat, tickets, or screenshots.
• Grant the replacement service account only the Google Cloud permissions required for the integration.
• Record the dataset name, rotation time, tester, and result without recording credential contents.
• Revoke the prior key after successful post-rotation testing.