How is SELF-XSS different from REFLECTED-XSS?

In both cases, some malicious script is injected in request data and is reflected back to the client's browser. For Reflected XSS, successful exploitation depends on a single HTTP request (GET or POST) which when replayed from the victim's browser (with help of some social engineering), results in script injection. In some cases this may not be possible. Some of the potential reasons for this are:

Presence of a CSRF token

The request with malicious data depends on other previous requests to be successful or has some other prerequisites. The response type for the affected HTTP request is text/json. In this case there would be no script injection if the request is sent on its own because the response is not HTML. In these cases, a successful script injection may be achieved while performing a test from the browser where CSRF token is taken care of, all the prerequisites are met and the text/json response is processed by some other page which mishandles the JSON data. However, it is not possible to develop an exploit that would work on a target machine once the user clicks on a single link. For these reasons, such cases are often termed as "Self XSS". Self XSS would generally be assigned a Low or Informational severity rating due to lack of exploitability.