App Passwords are a good start, they provide a way to make authorized requests, but unfortunately we can't specify the scope with them.
The AT Protocol documentation mentions:
OAuth is the primary mechanism in atproto for clients to make authorized requests to PDS instances. Most user-facing software is expected to use OAuth, including "front-end" clients like mobile apps, rich browser apps, or native desktop apps, as well as "back-end" clients like web services.
Most of possum is built using the core libraries, unfortunately gleam_crypto doesn't work on browsers, so adding it as a dependency will break everything. All work related to OAuth will be done in a separate package called opossum.