I have "Advanced Protection" turned on, so I just can't use this at all, because my newly created Google Cloud GCP app isn't trusted (even though I own it and I'm requesting read-only scopes). What a mess.

  Access blocked: [app name] is not approved by Advanced Protection. Error 400: policy_enforced