Will just a platform license do?

I have an external application that needs to call a webservice and auth a user against information held on the client record and one custom object (license).

Am I correct in understanding that the external application only needs a platform license to call the webservice as APEX will run as System and will have access to the core objects?