Some MYOB files require a second level of user details to gain access to them.
The CFTOKEN is the header that will pass this data for you.
Here is what that Login window looks like from the UI.
Here is how you format the header: x-myobapi-cftoken: [Base64Encode(username:password)]
Not every file requires the CFTOKEN to be passed, you will need to communicate with the MYOB Client and confirm how they log into their Company file.
If you have any questions, feel free to log a ticket with the Customisation & Integration Team.