Firebase Hosting REST API - The caller does not have permission - firebase

Question

I called Hosting API referencing Deploy to your site using the Hosting REST API but I got the following response:
{
"error": {
"code": 403,
"message": "The caller does not have permission",
"status": "PERMISSION_DENIED"
}
}
Code:
const { google } = require("googleapis");
var key = require('./service-account.json');
var jwtClient = new google.auth.JWT(
key.client_email,
null,
key.private_key,
"https://www.googleapis.com/auth/firebase.hosting",
null
);
jwtClient.authorize(function(err, tokens) {
if (err) {
console.error(err);
return;
}
console.log(tokens.access_token);
});
Shell:
$ node main.js
ya29.c.Elp0...
$ curl -H "Content-Type: application/json" \
-H "Authorization: Bearer ya29.c.Elp0..." \
-d '{
"config": {
"headers": [{
"glob": "**",
"headers": {
"Cache-Control": "max-age=1800"
}
}]
}
}' \
https://firebasehosting.googleapis.com/v1beta1/sites/[project-id]/versions
{
"error": {
"code": 403,
"message": "The caller does not have permission",
"status": "PERMISSION_DENIED"
}
}
The project id of service-account.json and the project id in api endpoint are the same.
On the other hand, I only got successful response when releases.list method:
$ curl -H "Authorization: Bearer ya29.c.Elp0..." \
https://firebasehosting.googleapis.com/v1beta1/sites/[project-id]/releases
{
"releases": [
...
]
}
Any tips on how to solve this problem?
Thank you.
Update:
The scope was wrong.
In the document, authorization scope is one of firebase.hosting, firebase and cloud-platform but I only got successful response when using https://www.googleapis.com/auth/cloud-platform.