They definitely can, even gcloud cli can authenticate without needing to create a oauth app.