An app password is a 16-character code Google issues so that apps and devices without full sign-in support (mail clients, custom scripts, transactional email systems) can send mail through Gmail's SMTP servers without using your real account password. This account comes with 2-Step Verification already enabled — a requirement Google enforces before it will generate app passwords at all.
Use it with smtp.gmail.com on port 587 (STARTTLS) or 465 (SSL) inside any mail client, CRM, or custom application that asks for SMTP credentials. Because the app password only grants mail-sending access rather than full account access, it's the recommended way to connect third-party tools to Gmail without exposing your main login.