Google AppScript BigQuery API call authentication - authentication

Question

I've previously developed simple GAS projects that read csv files and inserted them into a BigQuery table and I don't recall using any special authentication since both projects were under my account. However, I'm now getting an error when trying to insert.
{
"error": {
"code": 401,
"message": "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.",
"errors": [
{
"message": "Login Required.",
"domain": "global",
"reason": "required",
"location": "Authorization",
"locationType": "header"
}
],
"status": "UNAUTHENTICATED",
"details": [
{
"#type": "type.googleapis.com/google.rpc.ErrorInfo",
"reason": "CREDENTIALS_MISSING",
"domain": "googleapis.com",
"metadata": {
"method": "google.cloud.bigquery.v2.JobService.GetJob",
"service": "bigquery.googleapis.com"
}
}
]
}
}
One difference is that I am now using a personal google account, whereas before I was using a work account, though I haven't seen anything that mentions this distinction for calling BigQuery from GAS.
I've found some blogs that seem to address how to implement an oauth2 auth, but I'm wondering if something has changed in the past ~8months that now necessitates a more explicit auth for BigQuery calls? This doco doesn't mention anything about authenticating - https://developers.google.com/apps-script/advanced/bigquery.
edit:
This was for a csv load/insert job. I remembered that I was previously doing array inserts, and the auth for that job has not changed so I am able to successfully execute those jobs. No idea why the auth is different for a csv-blob job, but hopefully this will save others some time.

Answer 1

The BigQuery API uses OAuth 2.0 access tokens to authorize requests and grant temporary access to the API. In this case, I recommend using a service account to authenticate the API. You can follow these steps to create an account.
If you are using BigQuery client Libraries, you can set up the authentication. If not, you need to follow these steps.
Also, you must have permission to load data into bigquery. You need the following IA permission.
bigquery.tables.create
bigquery.tables.updateData
bigquery.tables.update
bigquery.jobs.create
If you are in cloud storage, you need the following permissions.
storage.objects.get
storage.objects.list (required if you are using a URI wildcard)