Use your own Concord access token, so every call is recorded against you.
The CRM's own sign-in page is protected by reCAPTCHA, so a password cannot be checked from here. A token is the supported way in — and revoking it in the CRM removes access to Callboard too.