At least the third party should ask for "Post on my behalf". Asking for Readonly access to only strictly required data is more convincing