Oauth scope discrepancy | Consent screen verification

[rustytim]

We're running into a strange issue, and hoping someone has run into this before.

Essentially running into a problem where oauth scopes are included in our consent screen that we are not knowingly requesting.

Here is the url our users are directed to in order to grant oauth access - note the scope param ( bigquury and adwords 😞

https://accounts.google.com/o/oauth2/auth
	?response_type=code	
	&client_id=our_client_id
	&redirect_uri=our_redirect
&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fadwords+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fbigquery
	&state=our_state
	&access_type=offline
	&prompt=consent
	&include_granted_scopes=true

 If we look at the oauth consent screen page in gcp, we again only see bigquery and adwords:

But then when a user actually navigates to the consent screen for our app, it prompts them for additional scopes( cloud-platform and bigquery.readonly 😞

We just want to remove the extra scopes, but can't seem to figure out where they are coming from and how to remove them.