Sign in via OAuth 2.0 PKCE — no password stored.
From Setup → App Manager → External Client App. Setup guide →