A website that I trust (Delta Airlines) offers a link to add flight information to Google Calendar; that link opens a window asking for my Google login and password. Based on the advice in a similar question (Can apps be trusted when requesting your credentials?) as well as my own skepticism, there's no way I'm providing my main Google password to Delta, even if it would work (which it probably wouldn't because I have 2-factor authentication set up with Google).
But Google has an "App Password" service set up for apps that can't handle 2-factor authentication. My question is: Would it be reasonably prudent to set up a Google app password for the Delta website, provide that password on the Delta interface, and then revoke the password after the calendar update is made?
(I assume Delta wants to create the calendar entry using a password, rather than a direct URL for which no password is required, so that they can update that entry with flight changes. And I realize that by revoking the password I would lose this functionality. I would prefer to take this risk of missing automated flight updates, forcing me to monitor flight changes directly, than to take the risk of leaving the Delta password active.)