Custom tokens

Minting Custom Tokens with the Admin SDK for Node.js - Firecasts

Firebase: Create custom tokens without service account credentials

If your code is not running in a managed runtime in Google Cloud, you must either provide a service account JSON file or at very least the serviceAccountId app option.

admin.initializeApp({
  serviceAccountId: '[e-mail]',
});

When you got to Firebase service account under settings it gives you the IAM role for the account

From How to create Firebase Authentication custom token without service account json in nodejs?