Configuring a Service Account to access GA was causing problems. Google_Auth_AssertionCredentials was being instatiated exactly as advised at that page. The private key had been saved from the developers console after being extracted from the JSON.
But then I was getting the strange error: Unable to load private key.
The key was provided to the API as a string, not a path to a file, so it seemed like an odd problem.
After digging around, I found that it was trying to parse a p12 file, which comes with certain constraints. One constraint is character encoding.
Google provided the key in json with the = encoded as \u003d.
Manually change that back to a standard =, and everything comes to life.