I created a new appengine project, which creates a default web app and associated client ID. When I try to use this client ID, I get "invalid client ID".
This looks like a bug in the cloud console.
To fix, I created an additional web app, which creates an additional client ID of the form 123456-randomness.apps.googleusercontent.com
The secondary client ID works.
When I go back and try the original client ID, that now works too.