I've been to two tournaments now where the timing of APT differed. In one tournament the defender used his defense tokens prior to the APT taking effect while in the other tournament the defender had to resolve the critical effect prior to using his defense tokens. Which one is it?

The timing for an attack is as follows;

1. Declare Target

2. Roll Attack Dice

3. Resolve Attack Effects (add, modify, etc)

4. Spend Defense Tokens

5. Resolve Damage

For the case of APTs it resolves at the start of step 5, before any other damage is dealt. So the defender must declare which defense token it will be using (and resolve evade and scatter) before the APT is resolved. Then damage is totaled and brace and then redirect defense tokens are resolved

It's as Belegon said.
I leave you the refference of the step 5 from the RRG, page 2:

5 . Resolve Damage: The attacker can resolve one of its
critical effects . Then the attacker determines the total
damage amount. Then the defending squadron or hull
zone suffers that total damage, one point at a time.

That is where Assault Proton Torpedoes goes

Correct answers above already. I just wanted to add this if you had any questions about the overall order of the attack sequence, which is a common argument point in Armada:

http://cannotgetyourshipout.blogspot.com/2017/04/the-attack-sequence-and-you.html

Everyone here is correct, I just want to point out that two of the defense tokens--redirect and brace--are spent before APT resolves, but do not resolve until afterward . This resolution order can be important if APT deals certain critical effects: Capacitor Failure, Projector Misaligned, Injured Crew, and Faulty Countermeasures, to name a few.