It changes with each new session.
In config/blesta.php look for this line:
Configure::set("Blesta.csrf_bypass", array());
You can add controllers and actions to this array to bypass CSRF checks, for the client login it should be array('client_login::index') so the following should work:
Configure::set("Blesta.csrf_bypass", array('client_login::index'));