I finally understood that you mean to add the actual word “openid” to the scopes. I had to go through and create a new Application from scratch and make sure all the reply URLs and other values were right. I now have it working.
I’m using this with Firebase functions and Dialogflow, so I had to use async/await to let the authentication and getProfile complete so the function didn’t return before the promise was fulfilled.