Should be using "openid" scope instead of "api" scope.

[stephen-smith]

gerrit-oauth-provider/src/main/java/com/googlesource/gerrit/plugins/oauth/GitLabOAuthService.java

Line 49 in 90b66bb

private static final String PROTECTED_RESOURCE_URL = "%s/api/v3/user";

Gerrit doesn't need "Full access to GitLab as the user, including read/write on all their groups and projects", it just needs to verify the user exists.