How is user’s password protected from application’s owner when using REST API?

Question

How can user’s password be protected from application’s owner when using REST API?

How a third party application should work with users’ data?

Answer 1

Long story short, they got a key from the user, so they don't use the user's password. The user can attach permissions to that key. That's all.