I think this step would still be necessary for extra security, because that isn't caught in the $client->authenticate step, and if you want to save the credentials for later "offline" use you would have to know which user the credentials belong to.

Alternatively you could also request people->get("me") and check against the ID in the response there, which would make the code cleaner, and has the advantage, that you have some additional information about the user which could be useful for your service.

But checking the Client_ID as below could probably be skipped.