"Cannot sign data without `client_email`" for getSignedUrl

I’m trying to get a signed url from a storage bucket, but am getting a signing error. I have permission to read from the bucket, and have been able to stream its contents fine.

Code:

  ...

  const expires = new Date()
  expires.setSeconds(expires.getSeconds() + 30)

  const storage = new Storage({ projectId });

  storage
    .bucket(bucketName)
    .file(`${directory}/${packageName}`)
    .getSignedUrl({
      expires,
      action: 'read',
    })
    .then(url => {
      res.send(url)
      console.log(url)
    })
    .catch(console.log)

Error:

{ SigningError: Cannot sign data without `client_email`.
    at /Users/pikelnys/Desktop/code/gcs-project/api/node_modules/@google-cloud/storage/src/file.js:1784:16
    at Auth._signWithApi (/Users/pikelnys/Desktop/code/gcs-project/api/node_modules/google-auto-auth/index.js:331:7)
    at getCredentials (/Users/pikelnys/Desktop/code/gcs-project/api/node_modules/google-auto-auth/index.js:316:14)
    at googleAuthClient.getCredentials (/Users/pikelnys/Desktop/code/gcs-project/api/node_modules/google-auto-auth/index.js:194:9)
    at /Users/pikelnys/Desktop/code/gcs-project/api/node_modules/google-auth-library/build/src/auth/googleauth.js:602:67
    at <anonymous>
    at process._tickCallback (internal/process/next_tick.js:188:7) message: 'Cannot sign data without `client_email`.' }

Environment details

• OS: macOS 10.13.4
• Node.js version: 8.11.2
• npm version: 6.4.1
• @google-cloud/storage version: 1.7.0

Edit: I’m getting this in both a local environment (where I authenticate with gcloud auth application-default login) and while the code is deployed to cloud functions.

[ollydixon]

Service account isn’t good for multi-stage environments and security. This should be reopened. You should be using the exposed environment that has the same values.

[barocsi]

Is this possible to authenticate without a keyfile?