Google sign-in fails with new devices

Describe the bug
After successful sign-in with MicroG, The generic error message pops up, and the account is not added.
This has been tested with many devices in a fleet. Any new devices (I suspect with a new android ID), have this problem, but older devices (with the same MicroG version) can still sign in to additional accounts as normal.

All phones tested have correct signature spoofing implementation and device registration etc turned on.

To Reproduce
Steps to reproduce the behavior:

1. Sign in to a google account, accept terms etc.
2. See error:

I looked into this issue further, and this is the end of the login logs, where the error occurs.

12-18 13:15:21.955  5209  5307 D GmsAuthLoginBrowser: JSBridge: clearOldLoginAttempts
12-18 13:15:21.966  5209  5307 D GmsAuthLoginBrowser: JSBridge: getAccounts
12-18 13:15:21.976  5209  5307 D GmsAuthLoginBrowser: JSBridge: getDroidGuardResult
12-18 13:15:21.986  5209  5307 D GmsAuthLoginBrowser: JSBridge: getAndroidId
12-18 13:15:24.528  5209  5307 D GmsAuthLoginBrowser: JSBridge: setAccountIdentifier
12-18 13:15:24.957  5209  5307 D GmsAuthLoginBrowser: JSBridge: setPrimaryActionLabel: Next
12-18 13:15:24.958  5209  5307 D GmsAuthLoginBrowser: JSBridge: setSecondaryActionLabel: Forgot password?
12-18 13:15:24.960  5209  5307 D GmsAuthLoginBrowser: JSBridge: setPrimaryActionEnabled
12-18 13:15:24.961  5209  5307 D GmsAuthLoginBrowser: JSBridge: setSecondaryActionEnabled
12-18 13:15:25.062  5209  5307 D GmsAuthLoginBrowser: JSBridge: log
12-18 13:15:25.523  5209  5307 D GmsAuthLoginBrowser: JSBridge: setAllActionsEnabled
12-18 13:15:32.647  5209  5307 D GmsAuthLoginBrowser: JSBridge: setAllActionsEnabled
12-18 13:15:32.651  5209  5307 D GmsAuthLoginBrowser: JSBridge: attemptLogin
12-18 13:15:32.656  5209  5307 D GmsAuthLoginBrowser: JSBridge: getDroidGuardResult
12-18 13:15:32.663  5209  5307 D GmsAuthLoginBrowser: JSBridge: getAndroidId
12-18 13:15:36.602  5209  5307 D GmsAuthLoginBrowser: JSBridge: setPrimaryActionLabel: null
12-18 13:15:36.605  5209  5307 D GmsAuthLoginBrowser: JSBridge: setSecondaryActionLabel: Try another way
12-18 13:15:36.606  5209  5307 D GmsAuthLoginBrowser: JSBridge: setPrimaryActionEnabled
12-18 13:15:36.608  5209  5307 D GmsAuthLoginBrowser: JSBridge: setSecondaryActionEnabled
12-18 13:15:36.698  5209  5307 D GmsAuthLoginBrowser: JSBridge: log
12-18 13:15:37.388  5209  5307 D GmsAuthLoginBrowser: JSBridge: setAllActionsEnabled
12-18 13:15:37.722  5209  5307 D GmsAuthLoginBrowser: JSBridge: getDroidGuardResult
12-18 13:15:37.733  5209  5307 D GmsAuthLoginBrowser: JSBridge: getAndroidId
12-18 13:15:39.315  5209  5307 D GmsAuthLoginBrowser: JSBridge: setAllActionsEnabled
12-18 13:15:42.473  5209  5307 D GmsAuthLoginBrowser: JSBridge: setAllActionsEnabled
12-18 13:15:42.479  5209  5307 D GmsAuthLoginBrowser: JSBridge: getDroidGuardResult
12-18 13:15:42.492  5209  5307 D GmsAuthLoginBrowser: JSBridge: getAndroidId
12-18 13:15:45.396  5209  5307 D GmsAuthLoginBrowser: JSBridge: setPrimaryActionLabel: null
12-18 13:15:45.400  5209  5307 D GmsAuthLoginBrowser: JSBridge: setSecondaryActionLabel: null
12-18 13:15:45.402  5209  5307 D GmsAuthLoginBrowser: JSBridge: setPrimaryActionEnabled
12-18 13:15:45.403  5209  5307 D GmsAuthLoginBrowser: JSBridge: setSecondaryActionEnabled
12-18 13:15:45.463  5209  5307 D GmsAuthLoginBrowser: JSBridge: log
12-18 13:15:45.819  5209  5307 D GmsAuthLoginBrowser: JSBridge: setAllActionsEnabled
12-18 13:15:49.955  5209  5307 D GmsAuthLoginBrowser: JSBridge: setAllActionsEnabled
12-18 13:15:49.958  5209  5307 D GmsAuthLoginBrowser: JSBridge: notifyOnTermsOfServiceAccepted
12-18 13:15:50.679  5209  5209 D GmsAuthLoginBrowser: pageFinished: https://accounts.google.com/v3/signin/speedbump/embeddedsigninconsent?TL=AHE1sGUj06skGuahm2uc6Q0yt5g8doFJ__yPfGpMLJ5xyJFesCP-x0jsbVt_ExF5&cc=gb&continue=https%3A%2F%2Faccounts.google.com%2Fo%2Fandroid%2Fauth%... (removed for privacy)
12-18 13:15:51.108  5209  5429 W GmsAuthLoginBrowser: onException
12-18 13:15:51.108  5209  5429 W GmsAuthLoginBrowser: org.microg.gms.common.NotOkayException: Error=ServerError
12-18 13:15:51.108  5209  5429 W GmsAuthLoginBrowser: 	at org.microg.gms.common.HttpFormClient.request(HttpFormClient.java:96)
12-18 13:15:51.108  5209  5429 W GmsAuthLoginBrowser: 	at org.microg.gms.common.HttpFormClient.lambda$requestAsync$0(HttpFormClient.java:210)
12-18 13:15:51.108  5209  5429 W GmsAuthLoginBrowser: 	at org.microg.gms.common.HttpFormClient$$ExternalSyntheticLambda0.run(Unknown Source:8)
12-18 13:15:51.108  5209  5429 W GmsAuthLoginBrowser: 	at java.lang.Thread.run(Thread.java:923)

I have also verified by checking the logs of GmsHttpFormClient that the app is receiving a valid oauth token from Google after the sign-in process, and is using it correctly to attempt to add an account. That http call, however, is returning a 403 error from Google.

I suspect Google have tightened the sign-in requirements for new devices, but I'm not sure yet what changes they have made.

Expected behavior
Google sign-in should complete successfully and the account should be added to the phone.

System
Android 11
Latest version of MicroG build from source (0.3.11)

I would be happy to work together with others to resolve
this as soon as possible.

My next steps would be to listen to the network calls of Google Play Services to see if anything differs from what we do. I suspect existing contributors will have much faster ways than me to check this.

At the least I would appreciate advice on which tools to use for this monitoring.

Start with GmsAuthLoginBrowser and the failing request at org.microg.gms.common.HttpFormClient.java:96; review the GmsHttpFormClient logs and compare the account-add network call with Google Play Services as suggested. Done means identifying why new devices receive HTTP 403 after obtaining a valid OAuth token and restoring successful account addition.