I get this error when trying to run my code:
oauth2client.client.AccessTokenRefreshError: unauthorized_client: Unauthorized client or scope in request.
Figured it out:
You need to use the client ID from your "Developers Console" as the Client Name in the "Manage API client access" when you're setting your API scopes
https://developers.google.com/+/domains/authentication/delegation
You need to also go to G Suite Admin for the domain, then click Security, Show More, Advanced Settings, Manage Api Client Access (or just browse to this at the time of writing).
Then add an entry that in the Client name has your client name and the Scope has your scope. For instance mine looks like this, you do not need all the scopes only the one appropriate for your purpose: