You'll need to understand several things to get the full picture. I'll try my best to help you understand.
They have to give you some API. The API's should take input using HTTP/S requests and give only data out in a format preferred by both(JSON/XML/CSV/other). Especially, the login part should use HTTPS so that the password and user name are not sent in plain text to the website. Once user keys in user name & password, they will be sent to server for authentication. Upon successful authentication, server should give you an authentication token or id that has a validity period(can be infinite also). After that, every request should use this authentication token. Indeed, the API should be designed that way to serve any account specific data only with an Authentication token. If the authentication token expires, then user has to login again to get a new token. This in a nutshell is the OAuth protocol(there is much more to it like clientID, client token). Google, Twitter, Facebook use this for their API.
If that site cannot give out API's, I can give you one terrible advice - Make your app work like a browser. i.e., Once you login, store the session cookie in the app and use it to request web pages. Then you scrap the web pages for the data you need and then display it in the app. Like I said, this is terrible advice, but a possibility that should be okay for minimal loads. For handling more loads/users, you should definitely go the API way.