I am trying to build an integration solution for my clients to pull their Contacts and Leads into our system. 

When I tried to look up the Salesforce API, all the documentation seem to require our clients to set up a connected app, and give us the oauth token to pull data. However, my clients also told me that all their existing integrations (e.g. marketo) are done through installing from the SF App Exchange, and they needed to provide a user token, username and password to marketo. 

This seems quite different from the connected app approach. I am confused about which option I should pick. Could someone clarify this for me?