Hi Mike,
The Blue Button API uses the Medicare.gov login screen as the first step for a Medicare enrollee to provide permission to their data. However, it is against the Blue Button 2.0 Terms of service to store or access this login information (https://bluebutton.cms.gov/terms/).
If you would like to maintain user accounts for your application, you are welcome to do so. However, those accounts would be separate from the Medicare.gov accounts used to authenticate by the end user. More information on authentication can be found here in our documentation: https://bluebutton.cms.gov/developers/#authorization
Once the user is authenticated, you can query the available resources to retrieve the patient, coverage, and Explanation of Benefits information. You can read more about calling the API in our documentation here: https://bluebutton.cms.gov/developers/#calling-the-api
Please let us know if you have any further questions.