I have a SPA that's supposed to interact with IoT Core and Cloud Pub/Sub through gapi.

First I used only IoT Core. I added the necessary scope both to the app configuration under APIs & Services / Credentials and my gapi client initialization call documented here.

It worked fine, the OAuth consent screen showed the new scope, IoT Core API calls were working.

Now I want to add Cloud Pub/Sub. Again added the scope to both the app configuration and the gapi initialization call. Here's the argument to gapi.client.init:

{
  apiKey: config.firebase.apiKey,
  clientId: config.clientId,
  discoveryDocs: [
    'https://cloudiot.googleapis.com/$discovery/rest?version=v1',
    'https://pubsub.googleapis.com/$discovery/rest?version=v1',
  ],
  scope:
    'https://www.googleapis.com/auth/pubsub https://www.googleapis.com/auth/cloudiot',
}

Yet, when I make a call to the Pub/Sub API, I get this response:

{
  "error": {
    "code": 403,
    "message": "Request had insufficient authentication scopes.",
    "status": "PERMISSION_DENIED"
  }
}

Here's what I tried:

• log out and then back in
• wipe browser cache and cookies
• revoke all permissions from the app in Google Accounts

Still no luck. The interesting thing is that although now both scopes are added to the app on the cloud side, after revoking app permissions and logging back in, the consent screen requests permission only for the IoT Core scope. The Pub/Sub scope doesn't show up there.

Any ideas what I'm missing?