Error on firebase admin nodejs Permission iam.serviceAccounts.signBlob is required

im using this tutorial: https://firebase.google.com/docs/auth/admin/create-custom-tokens#using_a_service_account_id

to create a node.js function (deployed to google cloud functions) to authenticate my users. the function is super simple:

const admin = require('firebase-admin');
admin.initializeApp({
   serviceAccountId: 'authenticator@igibo-b0b27.iam.gserviceaccount.com'
});


exports.authenticate = (req, res) => {
   let pass;
   let uid;
   if (req.query) {
      if (req.query.v == 3) {
         pass = req.query.p;
         uid = req.query.u;
      }

         admin.auth().createCustomToken(uid)
            .then(function(customToken) {
               res.status(200).send(customToken);
               return customToken;
            })
            .catch(function(error) {
               console.error("Error creating custom token:" + JSON.stringify(error));
               res.status(400).send(error);
            });

   } else {
      console.error("EMPTY to authentication");
      res.end();
   }
};

but im getting this annoying error:

{"code":"auth/insufficient-permission","message":"Permission iam.serviceAccounts.signBlob is required to perform this operation on service account projects/-/serviceAccounts/authenticator@igibo-b0b27.iam.gserviceaccount.com.; Please refer to https://firebase.google.com/docs/auth/admin/create-custom-tokens for more details on how to use and troubleshoot this feature."}

in the very same tutorial it says i must go to IAM and adjust some roles for the service account WHICH I DID but still getting this error.

this is a absolutelly simple task and shouldn't being such a hassle... what i am forgetting? the id is correct! the role is correct! the code is correct!

what is wrong?