Requested scopes not granted with gapi.auth2.init but granted with gapi.auth2.authorize for SOME users

[zbettenbuk]

We have a live app and just recently got a few reports that some (5%) users can't import files from Drive using the Picker api. Here is a detailed description of the problem: https://stackoverflow.com/questions/60931717/intermittent-the-api-developer-key-is-invalid-error

Since then we got a test user that constantly produces the issue, so we managed to dig a bit deeper.

What happens is that when we invoke gapi.auth2.init and then .signIn on the response, the requested scopes (e.g. drive.readonly and drive.file) are missing in the granted scopes list of the response. The user doesn't get a consent screen popup to grant or deny any scopes, and the requested scopes DO appear in myaccount.google.com. But as they are not returned in the granted scopes list, the consequent Picker API call fails (obviously).

Now we replaced the gapi.auth2.init call with gapi.auth2.authorize (same client ID, scopes...etc) and everything works fine. But we don't really want to use that API in production, because even Google describes this API as not recommended.

Any ideas?