Caller does not have required permission to use project

from google.auth import default
from google.auth.transport.requests import AuthorizedSession

credentials = default(quota_project_id='xxx-yyy')[0]
session = AuthorizedSession(credentials)
response = session.get('https://www.googleapis.com/oauth2/v3/tokeninfo')
print(response.json())

RefreshError: ('Unable to acquire impersonated credentials', '{
  "error": {
    "code": 403,
    "message": "Caller does not have required permission to use project xxx-yyy.
Grant the caller the roles/serviceusage.serviceUsageConsumer role,
or a custom role with the serviceusage.services.use permission,
by visiting https://console.developers.google.com/iam-admin/iam/project?project=xxx-yyy and then retry.
Propagation of the new permission may take a few minutes.",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.Help",
        "links": [
          {
            "description": "Google developer console IAM admin",
            "url": "https://console.developers.google.com/iam-admin/iam/project?project=xxx-yyy"
          }
        ]
      },
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "USER_PROJECT_DENIED",
        "domain": "googleapis.com",
        "metadata": {
          "service": "iamcredentials.googleapis.com",
          "consumer": "projects/xxx-yyy"
        }
      }
    ]
  }
}
')

------------------------------ Captured log call -------------------------------
2022-12-17 14:14:41.496 DEBUG Checking /home/runner/work/xxx/gha-creds-xxx.json for explicit credentials as part of auth process... (google.auth._default:218)
2022-12-17 14:14:41.509 DEBUG This service is instrumented using OpenTelemetry. OpenTelemetry or one of its components could not be imported; please add compatible versions of opentelemetry-api and opentelemetry-instrumentation packages in order to get BigQuery Tracing data. (google.cloud.bigquery.opentelemetry_tracing:66)
2022-12-17 14:14:41.509 DEBUG Converted retries value: 3 -> Retry(total=3, connect=None, read=None, redirect=None, status=None) (urllib3.util.retry:351)
2022-12-17 14:14:41.510 DEBUG Making request: GET https://pipelines.actions.githubusercontent.com/xxx/idtoken?api-version=2.0&audience=xxx (google.auth.transport.requests:192)
2022-12-17 14:14:41.516 DEBUG Starting new HTTPS connection (1): pipelines.actions.githubusercontent.com:443 (urllib3.connectionpool:1003)
2022-12-17 14:14:41.603 DEBUG https://pipelines.actions.githubusercontent.com:443 "GET xxx/idtoken?api-version=2.0&audience=xxx HTTP/1.1" 200 None (urllib3.connectionpool:456)
2022-12-17 14:14:41.604 DEBUG Making request: POST https://sts.googleapis.com/v1/token (google.auth.transport.requests:192)
2022-12-17 14:14:41.607 DEBUG Starting new HTTPS connection (1): sts.googleapis.com:443 (urllib3.connectionpool:1003)
2022-12-17 14:14:41.703 DEBUG https://sts.googleapis.com:443 "POST /v1/token HTTP/1.1" 200 None (urllib3.connectionpool:456)
2022-12-17 14:14:41.705 DEBUG Making request: POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/xxx.iam.gserviceaccount.com:generateAccessToken (google.auth.transport.requests:192)
2022-12-17 14:14:41.710 DEBUG Starting new HTTPS connection (1): iamcredentials.googleapis.com:443 (urllib3.connectionpool:1003)
2022-12-17 14:14:41.824 DEBUG https://iamcredentials.googleapis.com:443 "POST /v1/projects/-/serviceAccounts/xxx.iam.gserviceaccount.com:generateAccessToken HTTP/1.1" 403 None (urllib3.connectionpool:456)

      - run: |-
          curl https://www.googleapis.com/oauth2/v3/tokeninfo \
            --header "Authorization: Bearer ${{ steps.auth.outputs.access_token }}"

curl https://www.googleapis.com/oauth2/v3/tokeninfo \
    --header "Authorization: ***"
  shell: /usr/bin/bash -e {0}
  env:
    CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE: /home/runner/work/.../gha-creds-xxx.json
    GOOGLE_APPLICATION_CREDENTIALS: /home/runner/work/.../gha-creds-xxx.json
    GOOGLE_GHA_CREDS_PATH: /home/runner/work/.../gha-creds-xxx.json
    CLOUDSDK_CORE_PROJECT: xxx-yyy
    CLOUDSDK_PROJECT: xxx-yyy
    GCLOUD_PROJECT: xxx-yyy
    GCP_PROJECT: xxx-yyy
    GOOGLE_CLOUD_PROJECT: xxx-yyy
...
{
  "azp": "xxx",
  "aud": "xxx",
  "scope": "https://www.googleapis.com/auth/cloud-platform",
  "exp": "89837",
  "expires_in": "3599",
  "access_type": "online"
}