Connect to IAP protected endpoint with Workload Identity Federation

Question

I'm trying to create setup where I can run my code that will impersonate SA based on Workload Identity Federation and then call IAP protected endpoint (running on Cloud Run). I've managed to do such setup with Python library but I'm unable to do it in nodejs.

I've tried to combine samples regarding WIF and IAP but without any luck.

When running const client = await auth.getIdTokenClient(targetAudience); I'm getting error: Cannot fetch ID token in this environment, use GCE or set the GOOGLE_APPLICATION_CREDENTIALS environment variable to a service account credentials JSON file.

My GOOGLE_APPLICATION_CREDENTIALS var is pointing to valid external_account credentials file.

Could you please help me to connect those two?