## What happened
Calling getSignedUrl from the Node.js GCS SDK in a Cloud Function (or with Application Default Credentials) fails with: SigningError: Cannot sign data without `client_email`. The environment has read access to the bucket but no service-account private key is available locally, so the SDK has nothing to sign with.
## The fix that worked
The recommended path is service-account impersonation for signing: create a dedicated service account, grant the caller the IAM Service Account Token Creator role on it, and let the SDK sign through the IAM API instead of a local key. Users on the thread confirmed this works where ADC alone cannot sign. Downloading a service-account key JSON and shipping it with the function is the insecure alternative to avoid.