What are the minimum permissions needed by filepicker.io when integrating with Google Cloud Storage?

We are integrating filepicker.io with Google Cloud Storage (ie. asking filepicker to write the uploaded files to our Google Cloud Storage account). Their documentation is pretty clear, however I found that I have to give the service account "Editor" access to the whole project, which is a security concern for us (it means that if somebody gets access to the access tokens used by Filepicker, they can do whatever they want with our Google Cloud project instead of just having access to the file). Trying to use some more restrictive permissions (like "Storage Object Creator" + "Storage Object Viewer") makes Filepicker fail.

Had anyone managed to configure the Google Cloud Storage integration of Filepicker.io with something less than "Editor" access to the project?

Just wanted to note that in the mean time I implemented a workaround: I created a separate Google Cloud project and only gave "Storage Admin" access to that one to Filepicker. Then I gave permissions to the accounts from the other projects to use the given storage bucket from the "upload" project. So this way at least any token leaked on Filepicker's end is limited to accessing this "upload" project.

Solution

I just tested this and it seems that the minimum required role to store to GCS using Filestack/Filepicker is either the "Project Editor" role, or the "Storage Admin" role. I will submit a feature request to allow more varied role options.