Page History
...
To call a method, an app will need to pass a an authentication token for the user on behalf of whom the method is being called. This can either be the user (either a normal user or a bot).
For normal users, you receive this user token in the app.install event.
For a bot, you can see the token in the developer dashboard once after you enable it.
This token is passed as the token parameter in the HTTP request that calls the method.
...