Do I need an API Identity to use the OAuth Password flow?

In recent Platform releases (starting with 1909.1.2.0), yes. If you have an API that requires the Password flow, you need to create an API Identity, link it to that API and deploy it to the same environment. See the documentation regarding API Identity here.

If you use Platform releases earlier than 1901.1.2.0, OAuth Directory is responsible for authentication in the Password flow. You can see documentation about it here.