I got the answer to this from someone on Stack Overflow.... re-posting it here in case it helps someone.
Basically, in permissions, my account was missing the App Engine service account your-project-id@appspot.gserviceaccount.com
This happened to someone else too.