Am I correct in understanding that Nissan was using vehicle VINs as customer IDs and that’s why this worked?

Or is he saying in addition to customer IDs that the auth API also accepted VINs?