Generates the token used by the other endpoints from the email and the number of an order. The token is scoped to that order and to the given mode; for Returns it is the entry point to check eligibility (/orders), list shipping methods and create returns or exchanges. Partners send their API key in X-Api-Key: InvalidApiKey (401) when the key is unknown, revoked or created for another API, ApiKeyMarketplaceMismatch (401) when the order belongs to another marketplace. Without a key the call must come from a browser on a Drelife portal of the shop: ApiKeyRequired (401) when the request carries no Origin nor Referer at all, Domain is not allowed (400) when it comes from any other site. In Returns, the login is refused (403) when the email or the store lists of the marketplace block both the return and the exchange of the order: StoreSaleBlocked when the sales channel or the physical store it was sold at blocks both, EmailBlocked otherwise.