To use a service account outside of Google Cloud (BigQuery), such as on other platforms or on-premises, you must first establish the identity of the service account. Public/private key pairs provide a secure way of accomplishing this goal.
To create a service account key, please follow the next steps:
Step 1. Authorize in Google Cloud Platform and create a project if you don't have an existing one.
Enable the IAM API in 2 steps: Confirm the project(1) by pressing NEXT and then - enable API(2) by pressing ENABLE.
Step 2. When you are done, go to Home page console, select the APIs & Services tab and choose Credentials.
Step 3. Click Create Credentials and choose Service account.
Step 4. Go through the path of service account creating:
Is an owner role needed, instead of a custom role? Owner role vs custom role.
(1) Create Service account details. Email address for your account will be generated automatically. Copy it. Press Create and continue button.
(2) Grant this service account access to project. Press Continue button.
Continue with Service account permissions.
(3) Grant user access to this service account. Press Done button.
Note: Email addresses and domains must be associated with an active Google Account, Google Workspace account, or Cloud Identity account.
Step 5. When the Service account for your project is created, click Manage service account link.
On the Service account for your project page click Actions button and select Manage keys option.
On the Keys page press ADD KEY button and choose Create new key.
In the opened window pick JSON key type and push the Create button. Created key will be downloaded automatically.
Note, that for using BigQuery you have to enable billing on that project on the Home page console side menu.
💡 You can find more information about creating and managing service account keys here.