Ahh, I had misunderstood the logic here. I'm still a little confused; in my mind, it should be:

    if credentials:
      scopes = service.get('auth', {}).get('oauth2', {}).get('scopes', {}).keys()
      if scopes:
        if credentials.create_scoped_required():
          credentials = credentials.create_scoped()
        http = credentials.authorize(http)

Note that there's one subtle difference here: if `credentials` is provided, we call `.authorize` independent of `create_scoped_required`. 

Relatedly, there's something that confuses me -- user passes in `credentials`, and in some cases we create a new `credentials`. Now the user no longer has their hands on the credentials we're using for the `http`, which seems like it could cause confusion.