App Engine Go Standard-存储/图像API

I have issues to get the serving images API in combination with the Cloud Storage / Blobstore API working.

Images API: https://cloud.google.com/appengine/docs/standard/go/images/

First of all, I could not get it to work with the dev_appserver at all. It creates the BlobKey I can find it in the admin server but the log shows:

Blob with key 'encoded_gs_file:ZXBpbG90Z28uYXBwc3BvdC5jb20vZGF0YS9NYWNoaW5lcy8yNTk0Mzg2L2hlaWRlbGJlcmdfYmdfdjIucG5n' does not exist

Anyway I thought I would try it in the App Engine and here I managed to get it to work, but I need the given allUsers the access owner otherwise I get:

"API error 1 (images: UNSPECIFIED_ERROR)"

The Files where uploaded via gsutil as private. But I noticed that the Images have to be public in the storage? Or is this a bug, couldn't find anything in the docs, just that the serveURL will be public. If allUsers just have read access I get:

"API error 7 (images: ACCESS_DENIED)"

My testing code, it will just get first file from the given bucketpath and try to get the serveURL:

ctx := appengine.NewContext(c.Request())
bucketName, err := file.DefaultBucketName(ctx)
if err != nil {
    log.Println(ctx, "failed to get default GCS bucket name: ", err)
    return c.JSON(http.StatusBadRequest, err.Error())
}
client, err := storage.NewClient(ctx)
if err != nil {
    log.Println(ctx, "failed to create client: %v", err)
    return c.JSON(http.StatusBadRequest, err.Error())
}
defer client.Close()
bucket := client.Bucket(bucketName)
files := []storage.ObjectAttrs{}
query := &storage.Query{Prefix: "PATHTOFILE"}
it := bucket.Objects(ctx, query)
for {
    obj, err := it.Next()
    if err == iterator.Done {
        break
    }
    if err != nil {
        log.Println("listBucket: unable to list bucket %q: %v", bucketName, err)
        return c.JSON(http.StatusBadRequest, err.Error())
    }
    files = append(files, *obj)
}
fileName := fmt.Sprintf("/gs/%s/%s", files[0].Bucket, files[0].Name)
blobKey, err := blobstore.BlobKeyForFile(ctx, fileName)
if err != nil {
    errorMessage := Model.ErrorResponseMessage{
        Message: "FailedToGetBlockKey",
        Info: []string{err.Error()},
    }
    errors.Errors = append(errors.Errors, errorMessage)
    return c.JSON(http.StatusBadRequest, errors)
}
options := image.ServingURLOptions{Secure:true, Size:600, Crop:false}
url, err := image.ServingURL(ctx, blobKey, &options)
if err != nil {
    errorMessage := Model.ErrorResponseMessage{
        Message: "FailedToGetServingURL",
        Info: []string{err.Error()},
    }
    errors.Errors = append(errors.Errors, errorMessage)
    return c.JSON(http.StatusBadRequest, errors)
}
return c.JSON(http.StatusOK, url)