API admin account
The app checks passwords and opens tickets by calling WHMCS as this administrator. Pick a dedicated account with only the permissions the app needs rather than a person's day-to-day login, so you can revoke it without locking anyone out.