I don't think any of the identity platform APIs require an OAuth token in the request header...
https://cloud.google.com/identity-platform/docs/use-rest-api#section-verify-custom-token
If that is true, we should probably not require auth in the Client etc. (nor should we even depend on auth crates)...