When running the sample code from the Google Calendar API PHP Example Page, it said "Enter verification code:" at which point I put in my 2FA code from Google Authenticatior.
This produced "Fatal error: Uncaught InvalidArgumentException: Invalid token format in /vendor/google/apiclient/src/Google/Client.php:434"
I spent several hours verifying keys and json formats and googling, until I finally discovered that it does not want a 2FA token, it wants a completely different token.
If you copy and paste the link it gives you into a browser, get the token it returns, then copy and paste the token back into the "token" prompt, everything works.
This was 100% my fault, but I'm posting this here in the hopes of saving other people from also wasting time.
If any google employees are reading this, it would be nice to make the "token" prompt and the error message less ambiguous.