What ID and pasword should I use to run the scm command line process form a RTC command line build?

The ID must:

• Be associated with the particular repository
• Have membership/role sufficient to read source artifacts
• Someone must know the credentials.

The scm login can cache the password.  Not sure where or how it's stored.  One only has to provide password on the scm login command.  I usually add -n short-name to the login command (short-name might be the host part of the host name for example)  Subsequent scm commands using -r short-name do not use password which I presume you mean when asking about the diff command. 

See the RTC Knowledge Center / Rational Team Concert / Reference /

e.g. SCM

For maximal security, you would use the password file option.   Note that although the password file is encoded, to keep the password secure you need to read-protect the password file.   This ensures that the security of the password file is at the same level as the security of the operating system that manages the file.