The Google API requires a scope, even if that scope is the entire platform. f you’re not scoping to a specific service, you can just put in https://www.googleapis.com/auth/cloud-platform, which tells google that this user can access any service on the cloud platform.
More information on scopes can be found here: https://developers.google.com/identity/protocols/googlescopes