Error on firebase admin nodejs Permission iam.serviceAccounts.signBlob is required

Question

im using this tutorial: https://firebase.google.com/docs/auth/admin/create-custom-tokens#using_a_service_account_id

to create a node.js function (deployed to google cloud functions) to authenticate my users. the function is super simple:

const admin = require('firebase-admin');
admin.initializeApp({
   serviceAccountId: '[email protected]'
});


exports.authenticate = (req, res) => {
   let pass;
   let uid;
   if (req.query) {
      if (req.query.v == 3) {
         pass = req.query.p;
         uid = req.query.u;
      }

         admin.auth().createCustomToken(uid)
            .then(function(customToken) {
               res.status(200).send(customToken);
               return customToken;
            })
            .catch(function(error) {
               console.error("Error creating custom token:" + JSON.stringify(error));
               res.status(400).send(error);
            });

   } else {
      console.error("EMPTY to authentication");
      res.end();
   }
};

but im getting this annoying error:

{"code":"auth/insufficient-permission","message":"Permission iam.serviceAccounts.signBlob is required to perform this operation on service account projects/-/serviceAccounts/[email protected].; Please refer to https://firebase.google.com/docs/auth/admin/create-custom-tokens for more details on how to use and troubleshoot this feature."}

in the very same tutorial it says i must go to IAM and adjust some roles for the service account WHICH I DID but still getting this error.

this is a absolutelly simple task and shouldn't being such a hassle... what i am forgetting? the id is correct! the role is correct! the code is correct!

what is wrong?

Answer 1

Firebase mentions about this error on its docs:

https://firebase.google.com/docs/auth/admin/create-custom-tokens#failed_to_determine_service_account

You must initialize your app correctly through a JSON config file.

A simple fix would be:

1. Go to https://console.cloud.google.com/iam-admin/iam?project=PROJECT_NAME
2. Edit your default service account.
3. Add the role Service Account Token Creator

In a few minutes your project will be able to create signed tokens.