You make an "app password" which is basically an API token.
They've recently added OAuth, but since it's pretty new, a lot of older projects haven't moved over yet.
2FA exists but only for emails right now, more to come. https://github.com/bluesky-social/social-app/issues/1071
