How to get short lived access to specific Google Cloud Storage bucket from client mobile app?

Question

I have a mobile app which authenticates users on my server. I'd like to store images of authenticated users in Google Cloud Storage bucket but I'd like to avoid uploading images via my server to google bucket, they should be directly uploaded (or downloaded) from the bucket. (I also don't want to display another Google login to users to grant access to their bucket)

So my best case scenario would be that when user authenticates to my server, my server also generates short lived access token to specific Google storage bucket with read and write access.

I know that service accounts can generate accessTokens but I couldn't find any documentation if it is a good practice top pass these access tokens from server to client app and if it is possible to limit scope of the access token to specific bucket.

I found authorization documentation quite confusing and asking here what would be best practice approach to achieve access to the cloud storage for my case?

Answer 1

I think you are looking for signed urls.

A signed URL is a URL that provides limited permission and time to make a request. Signed URLs contain authentication information in their query string, allowing users without credentials to perform specific actions on a resource.

Here you can see more about them in GCP. Here you have an explanation of how you can adapt them for your program.