GP has written authorisation but they must mean identification, because only a resource owner can perform authorisation, not some random external service.