The actual request, after generating an auth token, is missing the auth headers. The code tries to [prepare the auth header using the source credentials, **presuming the passed in hash will be mutated**](https://github.com/googleapis/google-auth-library-ruby/blob/5c4ab1cfc3517d5490633c878cb5136ca4da75e6/lib/googleauth/impersonated_service_account.rb#L298C7-L302C10). However, `source_credentials` subclassing from BaseClient will [**return a modified copy of the passed in hash** rather than mutating the passed in hash](https://github.com/googleapis/google-auth-library-ruby/blob/5c4ab1cfc3517d5490633c878cb5136ca4da75e6/lib/googleauth/base_client.rb#L45C8-L49C10 ).