Okey sorry for the inconvenience, I found my answer. Here is what I've done:
on step 1 authorised API are:
https://www.googleapis.com/auth/admin.directory.group.member.readonly
https://www.googleapis.com/auth/admin.directory.group.member
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.group
on step 3 I'm making a post request with:
https://www.googleapis.com/batch
with a custom content-type: multipart/mixed; boundary="batch_foobarbaz"
body request:
--batch_foobarbaz
Content-Type: application/http
Content-Transfer-Encoding: binaryPOST /admin/directory/v1/groups/mytestgroup@domain.ext/members HTTP/1.1
Content-type: application/json{"email": "ldn@example.com", "role": "MEMBER"}
--batch_foobarbaz--
the important part here are the carriage return. They are mandatory after Content-Transfer-Encoding: binary and after Content-type: application/json