Not a dumb question, very much appreciate you keeping an eye out for your password security. It uses an OAuth flow so you're actually entering your credentials on accounts.spotify.com (Spotify-owned) and then Spotify gives this developer a token (rather than a username+password) to access your data (usually a very limited subset of data outlined on the login page).