They only need your customer ID - no first name is required. They then request access, you decide whether or not to authorise it, and assuming you do, they then have access.
But there's nothing temporary about it. Either you or they have to revoke access.
I don't know what they're up to, but if you haven't granted access you can safely ignore it.