Good morning @ebarr,
this is indeed tricky and the UI from the Google Dev Console doesn’t make things easier. Ideally you create a p12 file but json suffices as well.
403 clearly indicated access for the used credentials is wrong so I assume the user email and secret are incorrect. Please check my comment in this post for further guidance:
When granting access to Google Analytics it was also required to add the email from the Google Dev Console as a user … which is the most annoying and contradicting aspect about the process.
Best
Mike