Ozon does not sign its notifications — security rests on a secret address
Most marketplaces sign the notifications they send you, so you can verify that a notification genuinely came from that platform. Ozon does not. So if you use real-time order notifications, a secret token appended to the notification address becomes the only thing security rests on. Filling in the token is optional — but turning on real-time notifications without it means anyone who knows the address could send a fake order notification.
Leaving the token empty and keeping notifications off is a valid choice too; orders are then fetched by periodic polling and this risk never arises.