Another option is the JWT Bearer flow. I went into some pretty fine detail on the JWT Bearer flow in this other question
The setup is arguably more involved than the web-server flow.
- You don't need the client secret, but need an SSL certificate instead
- The process of constructing the JWT (JSON Web Token) is fairly involved
- You need to use a flow that generates a refresh token at least once before the JWT flow will work
One of the nice things about this flow is that you can specify a specific user to make requests on behalf of, and you don't need them to explicitly authorize the connected app. This is incredibly powerful, so exercising caution is wise. In my case, my org has a general "system" account that we use for things like integration. I don't have access to this user's email, or its password, but I don't need it.
Instead, Salesforce provides the option for administrators to pre-authorize users with certain profile(s) (which are selected by an admin).
For the JWT flow (haven't tried with other flows), while your sessions will still timeout, if you send a request before your session times out, the timeout will be reset (if current time is 08:00, timeout is 2 hours, and I send a request at 09:00, the session will now timeout at 11:00 instead of 10:00).