This is actually the first time I see someone requires an external pen test in order to access APIs. I wonder if this will become de-facto the standard for integrating with public APIs which serves any level of public information.
Seems to be that applications accessing certain Gmail APIs will need to go through a security assessment in 2019. The assessment will be performed by external auditors and will be in the price range $15k - $75k (or more for complex apps).