You could use the OAuth authentication API and let the user consciously giving user settings access to the service. As long as the service doesn't do anything with that data the agreement with the user doesn't permit, and the data is deleted upon the user's request, the service is GDPR compliant.