Secure Token for use in API calls
Using a string for storing a password is considered insecure because there is no possibility to delete that string from memory. From the SecureString documentation  


  An instance of the System.String class is both immutable and, when no longer needed, cannot be programmatically scheduled for garbage collection; that is, the instance is read-only after it is created, and it is not possible to predict when the instance will be deleted from computer memory. Because System.String instances are immutable, operations that appear to modify an existing instance actually create a copy of it to manipulate. Consequently, if a String object contains sensitive information such as a password, credit card number, or personal data, there is a risk the information could be revealed after it is used because your application cannot delete the data from computer memory. 


so it would be better to use a SecureString but unfortunately that isn't an option when using Aes because it doesn't take an SecureString as a parameter. So what other options are there ? Just take a char[] and overwrite its content when the class is disposed.  

The CreateSecureSessionTokenAsync() method should ideally return the token along with a random generated salt (maybe as tuple) to be stored in the data store to decrypt it later without the need that the customer will get the salt together with the token.  

An implementation of a random salt using a parameterized length can be found in my answer here.