What should password field be?

If I don’t use Firebase, but use the normal Discourse auth, what is the normal API flow for creating a user and then having that user login?

How long do the user API keys last? Do they expire?

Also, if I allow Google and Facebook logins, how are those users created in the Discourse server using API calls?

The CURL for creating a user indicates that an api_key and api_username are required. What are those if a user is trying to create a new account and they don’t have a key or username?

curl -X POST --data “name=dave&username=dave&email=dave@example.com&password=P@ssword&active=true” http://localhost:3000/users?api_key=test_d7fd0429940&api_username=test_user