Non-user applications can create signed URLs, see
Creating Signed URLs with a Program. You can do that in App Engine, if you want to enforce some kind of business logic, or let the external app create the signed URL by itself. With that approach the actual upload would go directly into the GCS bucket, without GAE in the middle.
However, if you don't need to return the unique ID in the response of the upload, you could consider to use a Google Cloud Function (Node.js and triggered by events in a GCS bucket, such as after an object is written into the bucket). The function gets the metadata of the written object and can create the unique ID and can write it to Cloud Datastore, for example, or to the custom metadata of the GCS object. For details see GCF's
Cloud Storage Tutorial.