Usually there is one API entry point where you authenticate with your secret and another one that you use to query after authentication.
There are more then just one way to authenticate. When you say, that you have two tokens, I would assume that 'authentication: bearer' is the way to go ...
Once we know which API, better what kind of authentication is required, we can guide you into the right direction (-;