I’m building an app that ask a user to select their calendar from calendar list, and then we check for busy slots. We don’t want to access calendars content, yet Google seems to require to use an elevated scope to access https://www.googleapis.com/calendar/v3/users/me/calendarList.

Indeed, per their doc, the lowest scope they require is https://www.googleapis.com/auth/calendar.readonly which falls under sensitive scope category in the consent screen, when auth/calendar.calendarlist.readonly should be sufficient:

I tried using the latter auth in the scope but I get error 403, which disappears if I use the former.

Any reason why and hope for change?