Application passwords do not exist yet; here is the interim answer

Authenticating a script against the REST API means either cookies and a nonce, which needs a browser, or basic auth over a plugin, which means a real password in a config file.

// a token stored as user meta, checked on every request
add_filter( 'determine_current_user', function ( $user_id ) {
    if ( $user_id ) {
        return $user_id;
    }

    $token = $_SERVER['HTTP_X_TURKERDEV_TOKEN'] ?? '';

    if ( '' === $token ) {
        return $user_id;
    }

    $found = turkerdev_user_id_for_token( $token );  // hashed lookup

    return $found ?: $user_id;
} );

Storing a hash rather than the token and comparing with hash_equals is the part that must not be shortcut, and the filter has to run over HTTPS or the token is on the wire in clear. Core adds application passwords in 5.6 with the same shape and a proper management UI, so anything built now should be structured to be replaceable. The temptation to accept the token as a query parameter should be resisted: query strings end up in access logs and in browser history.