The API Field Reference contains a list of all the XML elements you will encounter in the API. Additionally, it define the different data types used in each of those elements.
The Username is part of your API Credentials. This is not the Username you use to login to your Merchant Account.
The Token is a HMAC/SHA hash made from your password and the current time separated by a pipe character. By this method the token is time sensitive. A token will remain valid for 2 minutes. Your request must be made within two minutes after generating the token.
The format of the token before encryption is as follows: XVWWVPRGab|2010-07-16T06:52:00
After you form the token you must encrypt it using HMAC/SHA. You will find encryption samples for PHP, .NET, and Classic ASP in the samples section.