EAP (Extensible Authentication Protocol) carries authentication conversations between supplicant and RADIUS server. The authenticator passes EAP messages through without understanding them. This lets you deploy new authentication methods without changing network infrastructure.
EAP defines a framework, not a specific method. Many EAP types exist: some use passwords, others use certificates, some use both. Your choice depends on security requirements and what your environment supports. The supplicant and RADIUS server must both support the chosen EAP method.