For a newly created OAuth token - try waiting!
I had a weird experience just now.
I modified the example that shows labels to search messages but was getting an error:
var messages = await gapi.client.gmail.users.messages.list({'userId': 'me','q': 'from:someone@example.com'});API keys are not supported by this API. Expected OAuth2 access tokenor other authentication credentials that assert a principal. Seehttps://cloud.google.com/docs/authentication"
OK, so labels works with just an API key and messages doesn't.
I tried removing the q parameter to match the example above and suddenly it worked. So then I went off to try and figure out what that might mean and didn't get anywhere.
Then I added it back again and it worked right away!
So I can only conclude that newly created credentials may not be completely initialized.
And in fact they say as much:
Note: It may take 5 minutes to a few hours for settings to take effect