picasa with OAuth 2.0

.gitignore

/.bundle
/vendor/bundle
/.envrc

create_album.rb

# coding: utf-8

require "picasa"
require "signet/oauth_2"
require "signet/oauth_2/client"

oauth2_client = Signet::OAuth2::Client.new(
  token_credential_uri: "https://accounts.google.com/o/oauth2/token",
  client_id: ENV["GOOGLE_OAUTH_CLIENT_ID"],
  client_secret: ENV["GOOGLE_OAUTH_CLIENT_SECRET"],
  redirect_uri: ENV["GOOGLE_OAUTH_REDIRECT"],
  scope: "https://picasaweb.google.com/data/",
  refresh_token: ENV["GOOGLE_OAUTH_REFRESH_TOKEN"]
)

p oauth2_client.refresh!
p ::Signet::OAuth2.generate_bearer_authorization_header(oauth2_client.access_token)
picasa = Picasa::Client.new(user_id: ENV["GOOGLE_ACOUNT"], authorization_header: Signet::OAuth2.generate_bearer_authorization_header(oauth2_client.access_token))
p picasa.album.create(title: "api test", timestamp: Time.now.to_i)

Gemfile

source "https://rubygems.org"

gem "signet"
gem "picasa"

Gemfile.lock

GEM
  remote: https://rubygems.org/
  specs:
    addressable (2.3.8)
    extlib (0.9.16)
    faraday (0.9.1)
      multipart-post (>= 1.2, < 3)
    httparty (0.13.5)
      json (~> 1.8)
      multi_xml (>= 0.5.2)
    json (1.8.2)
    jwt (1.5.0)
    multi_json (1.11.0)
    multi_xml (0.5.5)
    multipart-post (2.0.0)
    picasa (0.7.5)
      httparty
    signet (0.6.0)
      addressable (~> 2.3)
      extlib (~> 0.9)
      faraday (~> 0.9)
      jwt (~> 1.0)
      multi_json (~> 1.10)

PLATFORMS
  ruby

DEPENDENCIES
  picasa
  signet

This looked like the best example that I've been able to find with Google, but I still keep on getting
signet-0.6.0/lib/signet/oauth_2/client.rb:947:in `fetch_access_token': Authorization failed. Server message: (Signet::AuthorizationError)

If you have any suggestions, I would really appreciate it.
oauth2_client = Signet::OAuth2::Client.new(authentication_uri: "https://accounts.google.com/o/oauth2/auth",
token_credential_uri: "https://accounts.google.com/o/oauth2/token",
client_id: "XXXXXXXXXXX-lotOfGibberish.apps.googleusercontent.com",
client_secret: "clientSecretFromGoogleConsole",
redirect_uri: "urn:ietf:wg:oauth:2.0:oob",
scope: "https://picasaweb.google.com/data/",
refresh_token: "inventedStringHere")
p oauth2_client.refresh!

Lot of people have blamed clocks, so here is my ntp info:
ntpq -p
remote refid st t when poll reach delay offset jitter
*defra1-ntp-002. .GPSs. 1 u 2 64 377 41.766 31.970 8.969