You can automatically apply policies such as expiration and manual rotation to API keys/tokens. You can’t really do that seamlessly for username/password combinations.