Avoid 'Invalid Credentials' with Google OAuth2

I was struggling setting up OAuth2 authorisation to Google and the problem was down to the scope I was requesting.

I requested https://www.googleapis.com/auth/calendar in order to access the Calendar API on behalf of the user but was receiving

"reason": "authError",
"message": "Invalid Credentials"

Turns out you also have to request the https://www.googleapis.com/auth/userinfo.email scope as well as the scopes you're interested in. Google returns the email in the credentials hash and thus, I believe, if you haven't requested access to it you can't read it.