Yes, I think this makes sense. I think if you are paying by token w/ an API key, then you're good to go, but if you're hijacking their login system then that's a different story.