How to Connect Metabase to Google Sheets
To understand how to connect Metabase to Google Sheets, you must route data through an intermediate store. Metabase does not read spreadsheets as a direct database source, so teams link sheets to BigQuery or export CSV files. Many teams set up this flow with broad service roles that read every table. When permissions are too wide, any shared sheet or dashboard query can expose raw data. How to connect Metabase to Google Sheets in practice Data teams usually pick one of two paths for this setu
End-to-End Encryption: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To understand how to connect Metabase to Google Sheets, you must route data through an intermediate store. Metabase does not read spreadsheets as a direct database source, so teams link sheets to BigQuery or export CSV files. Many teams set up this flow with broad service roles that read every table. When permissions are too wide, any shared sheet or dashboard query can expose raw data.
How to connect Metabase to Google Sheets in practice
Data teams usually pick one of two paths for this setup. The first path pulls spreadsheet data into Metabase for charts. You link your Google Sheet as an external table inside Google BigQuery. Then you connect Metabase to that BigQuery project using a service account key. Metabase runs SQL queries against BigQuery, which reads the live sheet rows on demand.
The second path sends Metabase query results out to a spreadsheet. You save a question in Metabase and turn on public sharing or use the API. Then you use a spreadsheet import function to pull the CSV link into Google Sheets. Both paths rely on static keys or shared links to move data between tools. Admins often reuse one high-level database role for all these links to save time.
Why native spreadsheet links create security gaps
Linking spreadsheets and business tools solves the basic reporting problem for analysts. Finance and operations teams can join manual sheet targets with production database tables. Still, this native setup only checks who logs in at the start. It does not check what individual queries do while they run.
A single BigQuery service account gives Metabase full read rights across entire datasets. If a user writes a broad query, the database sends back every column by default. Sensitive fields like customer emails, phone numbers, and card numbers flow straight into dashboards or sheets. Public CSV links create a larger risk because anyone with the URL can pull the data. Native database roles cannot rewrite matched fields in results on the fly for specific users. You also lack a clear audit log that ties sheet imports back to specific people.
End-to-End Encryption: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Securing data flows between analytics tools and sheets
To reduce risk, teams must tighten how Metabase talks to underlying data stores. Start by creating a dedicated database role just for your reporting tool. Grant this role read rights only to the specific views needed for your sheets. Remove raw personal fields from those views before Metabase ever queries them.
You should also avoid public CSV links when exporting query results to spreadsheets. If you use the Metabase API to feed a sheet, rotate those user keys often. Even with strict views, static roles remain hard to manage as teams grow. Every new sheet request pushes admins to widen table permissions again. True control requires inspecting queries in flight and applying data masking rules to sensitive columns.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Can Metabase query a Google Sheet without a database in the middle?
No, Metabase needs a SQL database or warehouse to read your data. You must sync the sheet into a database like Postgres or link it through BigQuery first.
What is the safest way to send Metabase results to Google Sheets?
Avoid public links that expose your query results to anyone on the web. Instead, pull data through authenticated API scripts and mask fields like emails or phone numbers first.
Why do my Google Sheets edits take time to show up in Metabase?
Metabase caches query results, and sync tools run on fixed schedules. If you use BigQuery external tables, queries read live sheet data once the Metabase cache clears.