I’m trying to use the userlogin mutation but does this require a token to do? and if so what do I do with the access token once the user has logged in successfully?
Sorry big newbie here 
No worries!
You actually cannot use a token when running the userLogin mutation. So make sure you have no Authorization header set on those requests (i.e. they won’t work in the API Explorer!)