In IAM, the cloud run service account should have the "Service Account Token Creator" permission to generate a signed link. You should check your permissions to allow all the ones needed