I’m also trying to use pulumi to set up IAP
the error you encountered is probably because your brand is set up as public
https://cloud.google.com/iap/docs/programmatic-oauth-clients#branding
you cannot use the api to create an oauth client if your brand is public
for me changing the brand to internal solve this issue