At https://en.wikipedia.org/wiki/Special:ListGrants it says "Authentication only, no API access."
I think the wording is confusing. Doesn't all authentication happen via an API? Perhaps this could be reworded to be clearer such as "Identity verification only, no ability to act on a user's behalf"?
GCI task: https://codein.withgoogle.com/dashboard/tasks/5920026922057728/