Yotpo uses tokens to authenticate and authorize an account. Tokens are generated by an API call that uses the client ID and client secret. See the Token API Reference Guide.
A token is required in non-public API calls to ensure private account data is accessible only by authorized users.
Storefront endpoints on api-cdn.yotpo.com are public and need no token. Most merchant endpoints take the token in the X-Yotpo-Token header, the Insights API takes it as Authorization: Bearer, and Custom albums takes it as a utoken query parameter.
For a step-by-step walkthrough, see Authenticate and make your first call.