Authentication using username/email and password

It will depend ultimately on the method that you're trying to do all of this? You can use API_authenticate but ultimately your users still need to provide that in some way - so if you're using a web page then you can have them enter their credentials and then store the ticket for their browser session and reuse that ticket over and over to query different tables, perform downloads etc. 

There aren't any limitations per say to using the Authenticate call - you can set your own timeout if you wanted so that it only lasts for 1 minute lets say but beyond that the only limitation of the auth ticket is related to security within the application itself, so if a user normally can't see a record or table then the ticket will maintain that security. 

I'll refer back to my first question though - and 'where' are you trying to do this? Unless you're using a generic username/password that everyone is using you will need some kind of interface for them to provide their own - which at that point you're better off having them just sign into Quickbase and use a codepage type setup that you can perform your queries and downloads via javascript since authentication would already be handled.