I faced this issue and stumbled upon RevenueCat's setup guide. It turns out that you have to invite the service account to your Play console.

My code setup

import { androidpublisher } from '@googleapis/androidpublisher';
import { GoogleAuth } from 'google-auth-library';

const android = androidpublisher({
  version: 'v3',
  auth: new GoogleAuth({
    keyFile: '../secrets/firebase-service-account.json',
    scopes: ['https://www.googleapis.com/auth/androidpublisher'],
  }),
});

(async () => {
  const a = await android.reviews.list({
    packageName: 'com.example',
  });
  console.log(a.data);
})();