I have a complex environment where a third party needs to send a verification email to the user via https://cloud.google.com/identity-platform/docs/reference/rest/v1/accounts/sendOobCode without the idToken.

I know this can be done via GOOGLE_APPLICATION_CREDENTIALS, however I don’t want the third party to call any other firebase-admin API.

The scopes like https://www.googleapis.com/auth/cloud-platform & https://www.googleapis.com/auth/identitytoolkit seem broad and not fine grained to limit the third party. What am I missing?