Cross project management using service account

I have confirmed that custom token signing worked with @Zachary Newman's procedure.

My concrete procedure of how I created a custom token in a GAE app in project A which can be used to connect to Firestore of project B is as follows:

1. In "IAM" page of project B, add service account {project-a}@appspot.gserviceaccount.com which is a GAE default service account of project A.
2. In "IAM" page of project B, assign "Service Account Token Creator" role to {project-a}@appspot.gserviceaccount.com.
3. Call the Firebase Admin SDK initializeApp method in a GAE app in project A with specifying firebase-adminsdk-xxxxx@{project-b}.iam.gserviceaccount.com, which is a service account with "Firebase Admin SDK Administrator Service Agent" in project B, as serviceAccountId and https://{project-b}.firebaseio.com as databaseURL and then create a custom token.

You should be able to add a service account to another project:

1. Create the first service account in project A in the Cloud Console. Activate it using gcloud auth activate-service-account.

2. In the Cloud Console, navigate to project B. Find the "IAM & admin" > "IAM" page. Click the "Add" button. In the "New members" field paste the name of the service account (it should look like a strange email address) and give it the appropriate role.

3. Run gcloud commands with --project set to project B. They should succeed (I just manually verified that this will work).

Automatic creation of service accounts is something that we're hesitant to do until we can work through all of the security ramifications.

I know its a bit old, but if anyone is still looking for this,To add to @Zachary Newman answer, To make things clear, After you created a service account in project A you should go to project B to "IAM" (not "Service Accounts"), There you will be able to add the email you just created with proper roles.