GCS getSignedUrl fails: Cannot sign data without client_email
The recommended path is service-account impersonation for signing: create a dedicated service account, grant the caller the IAM Service Account Token Creator role on it, and let the SDK sign through the IAM API instead of a local key. Users on the thread confirmed this works where ADC alone cannot sign. Downloading a …
Problem outcome: unknown