This looks like a bug in the cloud console.
To fix, I created an additional web app, which creates an additional client ID of the form 123456-randomness.apps.googleusercontent.com
The secondary client ID works.
When I go back and try the original client ID, that now works too.