Magic links are the default. Google identity sign-in requests no Contacts, Gmail, or Calendar scopes.