What scopes do I need in my service account? I’m getting “Request had insufficient authentication scopes".