Generate Cloud Storage signed URL from Google Cloud Function without using explicit key file

I want to create a presigned upload URL to the bucket and want to avoid explicitly referencing the json key.

Currently I'm trying to do this with the default App Engine service account

I am trying to follow this answer but I am getting this error:

AttributeError: You need a private key to sign the credential. The <class 'google.auth.compute_engine.credentials.Credentials'> credential you are currently using contains only a token. See https://googleapis.dev/python/google-api-core/latest/auth.html#setting-up-a-service-account for more details .

My Cloud Function code looks like this:

from google.cloud import storage
import datetime
import google.auth

def generate_upload_url(blob_name, additional_metadata: dict = {}):
    credentials, project_id = google.auth.default()
    # Perform a refresh request to get the access token of the current credentials (Else, it's None)
    from google.auth.transport import requests

    r = requests.Request()
    credentials.refresh(r)

    client = storage.Client()
    bucket = client.get_bucket("my_bucket")
    blob = bucket.blob(blob_name)
    
    service_account_email = credentials.service_account_email
    print(f"attempting to create signed url for {service_account_email}")
    url = blob.generate_signed_url(
        version="v4",
        service_account_email=service_account_email,
        access_token=credentials.token,
        # This URL is valid for 120 minutes
        expiration=datetime.timedelta(minutes=120),
        # Allow PUT requests using this URL.
        method="PUT",
        content_type="application/octet-stream",
        
    )
    return url


def get_upload_url(request):
    blob_name = get_param(request, "blob_name")
    url = generate_upload_url(blob_name)
    return url