The scope is a requirement of the [Service Account Credential generateAccessToken API](https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateAccessToken) WIth "impersonated_service_account" credential type, if the scope is not set, the token request fail. The idea is to add a scope by default (i.e. the Cloud Platform scope) if no scope is provided.