We had a similar scenario, you have to be authenticated yo use the API of salesforce, but it doesn't have to be a login and password it could be a token with auto refresh obtained with oath from salesforce, the API support this kind of integration, I recommend to use a component to communicate with the API, it is posible to implement all the functions directly but with all the methods it have is difficult to do so, we use jsforce to integrate with our salesforce from our existing project, you have to search for other component more suitable if you are not comfortable with the one I suggest.
And if you want, you can check the documentation for all the apis in salesforce.
In that documentation you have an article that explain the oauth2 authentication technique and the refresh token method.
We use the jsforce component, so I'm not sure how to accomplish this in a vanilla way, I think REST API documentation could be a good start to understand the way of authentication and the different flows, it could be different for SOAP but is not going to be entirely different. In that documentation the section Understanding Authentication explain the way the different types of authentications works, I know is going to be a extensive read, I'm not entirely confortable in the Java world, but I think this repository implements a lot of the things you have to implement, could be a good start point or even use the repository as a library, I also find this other repository. Additionally there is this specific course in pluralsight that you should check out.
I hope this could help.