In setting up staging, there are 2 ways the Staging and the Live site authorize content pushes.
One is using a username and password. You set it on the Live Server (any username and password you want, does not have to be an actual user), then the staging site uses that username and password to validate itself, saying "Hey Live site, i have your username and password, so i'm authorized to push changes to you).
The other is through a key, same principle, it's just a very complex random key.
See here at the portion talking about Server Authentication