App passwords

Your phone or desktop calendar keeps one of these instead of your mailbox password. Each is scoped, shown once, and can be revoked on its own. Your calendar stays on this server — CalDAV is how Apple Calendar, Thunderbird and the rest talk to it.