I am getting a
GoogleAuthException: Unknown error
GLSUser: GLS error: INVALID_AUDIENCE <email> audience:server:client_id:xxx.apps.googleusercontent.com
Looks like that should work; here's the scope-init code from my app which does work.
private static final String SCOPE = "audience:server:client_id:" + SERVER_CLIENT_ID;
So it smells to me like there's a problem with the client id. Remember that
It's the client ID from #3 that goes after ...:client_id: