A dedicated Jenkins user with an API token, not the admin account. Needs Job/Create as well as Build and Read, because builder creates an app's job on first deploy — which is what guarantees the SCM polling trigger exists and so that a webhook can ever find it (issue #30).