For anyone else who arrives here, I had the same problem, but the solution was a little different...
And when I got to this section, it created a separate Web Application (is this due to the recent upgrade?).
-------------------8<----------------------------
Based on your domain policies, you may have to mark GAM as a trusted app.
* Access the admin console and go to Security -> Access and data control -> API controls
* Check Trust internal, domain-owned apps
* Click Manage third-party app access
* Click Add app and select OAuth App Name or Client ID
* Paste client_id value from client_secrets.json
* Click Search
* Click Select at right end of line referenceing GAM
* Check box to the left of the line with GAM client ID
* Click Select
* Click Trusted: Can access all Google services
* Click Configure
---------------------------->8-------------------
Then I did...
gam oauth refresh
gam oauth update
gam user
us...@example.com check serviceaccount
gam info domain
This finally solved the API Access Denied error.