You are the Google Workspace Administrator for a software company developing third-party applications that utilize Google Workspace APIs. Due to the sensitive nature of some data, you decide to implement API Controls. What is a primary step to ensure that only applications complying with security standards can access specific Google Workspace APIs?