What is the difference between userID and user token? Can they be the same?

User ID and the token are different - userID is fixed in your user database, whereas the user session token is changing depending on the user login/logout. In order for us to be able to identify the user, a user session token should be provided when the user logs in and can be matched to the userId through your wallet API. You can pass a "null" token or omit it completely during the initialisation, but that would prevent placing bets (the user would be logged out).
You need to have a Wallet API set up on your side; the user session token you send when initialising the iFrame should get a correct response from your /userDetails API endpoint when it is sent by our iFrame to your API.