I only use SSH keys, but if one uses a sufficiently complex password my understanding is that the primary risk of a password vs key is that the SSH host gets a

I only use SSH keys, but if one uses a sufficiently complex password my understanding is that the primary risk of a password vs key is that the SSH host gets a copy of it (specifically /etc/shadow). If you control the host, I could see a password being an acceptable solution, maybe. Worlflow/shortcuts can also arbitrarily HTTP GET/POSTs which is likely the better route in any case.