How do I use a Cognito token with API?

I've successfully signed into an iOS app using Google oAuth and been able to get a Cognito token and ID. Now, I'd like to call a node.js API to perform some action on DynamoDB.

What and how do I pass to my API call? What authentication and suthorisation checks can I perform in the API method itself?

Background: I don't want to expose/leak and details of the underlying storage back to the user so I won't be using DynamoDB, for example, from within the app itself.