Authorize requests to app engine app with a service account

I am using the app.yaml's login: admin in handlers to restrict access to my app only to selected Google accounts (which I can edit in IAM). I'm using the python27 standard environment on GAE.

I would like to use the JSON API my app exposes from another server app (not hosted on GAE). Using a service account looks like a straightforward solution, but I am unable to get the scopes or the request itself right, so the endpoint would see an authenticated Google user.

The service-user currently has Project/Viewer role in the IAM. I tried a few more like AppEngine/Viewer, AppEngine/Admin. I also tried some more scopes.

My test code:

"""Try do do an API request to a deployed app
with the current service account.

https://google-auth.readthedocs.io/en/latest/user-guide.html
"""
import sys

from google.auth.transport.requests import AuthorizedSession
from google.oauth2 import service_account

def main():
    if len(sys.argv) < 2:
        sys.exit("use: %s url" % sys.argv[0])

    credentials = service_account.Credentials.from_service_account_file(
        'service-user.json')
    scoped_credentials = credentials.with_scopes(
        ['https://www.googleapis.com/auth/cloud-platform.read-only'])
    authed_http = AuthorizedSession(scoped_credentials)

    response = authed_http.request('GET', sys.argv[1])

    print response.status_code, response.reason
    print response.text.encode('utf-8')

if __name__ == '__main__':
    main()

There is no error, the request behaves like unauthenticated. I checked the headers on the server, and while requesting from the browser there are several session cookies, the AuthorizedSession request contains single Authorization: Bearer .. header.