To start with, I’m creating my Android app by modifying photon-tinker-android.  I’ve created the product in the Particle console, created simple auth credentials within the product, added these to the app as well as set the productMode and product_id resources in the app. 

After calling startDeviceSetup from the (initialised) Device Setup Library, I’m able to log in fine but when pressing the “READY” button on the “Time to set up your…” screen I’m getting the following ParticleCloudException error shown in a pop-up:

Error
Could not communicate with Photon cloud.  Make sure your Android device is connected to the internet and retry. 
retrofit. RetrofitError: 400

This is both on an emulator (which I think doesn’t work with the setup SDK?)  and actual phone. 

Looking at the HTTP logs, the log in and token creation seems to be fine, but the call to /v1/products/6621/device_claims is failing with: "error":"invalid_scope","error_description":"Permission denied"

You’re using simple auth with a product, correct?  Make sure you’re setting all of the appropriate values in your resource file.  You can put them in strings.xml, but I usually make a separate file for the product settings:

In app > res > values > customization.xml, create a new file and add the following: