In setting up the Google Picker API I initially set it up to use this scope: https://www.googleapis.com/auth/drive.metadata.readonly which listed 2 services as expected.
When updating the picker to use this scope instead: https://www.googleapis.com/auth/drive.readonly (which is less privileged), the picker is still listed it as having access to the previous.
How do I update this so that it uses the correct scope? It's not clear where it's being captured.
Scope docs: https://developers.google.com/identity/protocols/oauth2/scopes#drive