When UserCredentials obtains a refreshed token from credentials that were loaded from application_default_credentials.json, it uses "access_token" instead of "id_token". My Cloud Endpoints setup seems to require a base64 JWT, i.e. "id_token".

If this is a new use case, I'll be happy to submit a PR to add this capability.