Creates a browser session and returns a handoff code for the hosted flow. Uses standard API key or JWT authentication (not the JWT returned by the exchange endpoint).