gmail api via service account: googleapiclient.errors.HttpError: <HttpError 400 when requesting [...] returned "Bad Request">

[Tim Pierson]

I have a simple test that's throwing a 400 on the REST call.  I have a service-account added in the developers console and domain-wide delegation is enabled; my single us...@domain.com email (which is aliased as CLIENT_EMAIL below) is added as an Owner under the associated permissions; and I have the corresponding JSON downloaded locally.  However, I seem to be unable to use any of the listed gmail api methods.  Is there a configuration or permission setting I'm missing somewhere?

from oauth2client.service_account import ServiceAccountCredentials
from apiclient.discovery import build

def test():
    scopes = ['https://www.googleapis.com/auth/gmail.modify',
              'https://www.googleapis.com/auth/gmail.send',
              'https://www.googleapis.com/auth/gmail.readonly',
              'https://mail.google.com/']
    credentials = ServiceAccountCredentials.from_json_keyfile_name(
        'GmailApi-________.json', scopes)
    gmail = build('gmail', 'v1', credentials=credentials)
    response = gmail.users().messages().list(userId=CLIENT_EMAIL).execute()

    print(response)

[Tim Pierson]

I should also add that delegating the us...@domain.com with credentials = credentials.create_delegated(CLIENT_EMAIL) results in:

oauth2client.client.HttpAccessTokenRefreshError: unauthorized_client: Unauthorized client or scope in request.