The Python Tic Tac Toe sample appears to be in need of an update. ID tokens are no longer required in this particular case. (The Java example is using Google+ login, so it has slightly different requirements.)
You can leave out manipulation of the token, and it will automatically work for Endpoints and whatever other Google API you are calling. See the Python "Hello Endpoints" example for what this looks like (most notable for what isn't in it).