You need a couple of things to use the Spotify API: an application and it's client ID and client secret, and an authorisation token. We will generate a refresh token, and use that to generate authorisation tokens on the fly. Once you have these, you can set them as environmental variables or reference them in your dotenv file as in the funtion I read these from process.env.
To generate these two, you need to make a spotify app, then when you visit the page of your application you'll see "Client ID" and "SHOW CLIENT SECRET" which will show you each of these respetively.
Follow the authorisation guide to get your refresh token. When generating your refresh token, make sure you set the correct scopes. For the example here, getting the users recently played tracks, you can see (as the time of writing) it needs the scope user-read-recently-played.
You can also use the web api auth example to generate a refresh token.