To call a method, an app will need to pass a an authentication token for the user on behalf of whom the method is being called. This can either be the user (either a normal user or a bot).
For normal users, you receive this user token in the app.install event.
For a bot, you can see the token in the developer dashboard once after you enable it.
This token is passed as the
token parameter in the HTTP request that calls the method.