It’s all clearly defined in ADR-007 https://github.com/home-assistant/architecture/blob/master/a...

The TL;DR: Authentication for devices and services are via the UI only (to deal with OAuth2, refresh tokens, auto-updating IPs via mDNS). Automations/scripts/scenes are both YAML or UI.