Can I create an object without a token? The object is created with user X’s id.
I don’t think you should be creating any data without a token. Data should always be owned by a user and permissions used to control who has access.
If you create without a token then any random person could see customer’s data that they’re not meant to.