How can I allow access to firebase storage through a secret key

I would like to use firebase storage as a CDN origin, and to do so I need to allow access via a secret key supplied through either a header or the query string.

I have tried to use request.params in the storage rules, but no matter how I structure it, I cannot get it to work

service firebase.storage {
    match /** {
        allow read: if request.params.access_token == 'fake';
        allow write: if false;
    }
}

Has anyone else successfully managed to allow access to the resources via a secret key. I have seen suggestions to use a signed token, but that seems to expire after an hour, and this secret will need to live many orders of magnitude longer than that