To get any non-public data or modify anything, you need to authenticate your API calls as an administrator.
The method AuthToken.create is used to create a new persistent authentication token. They may only be created from a session that is authenticated via Admin.login.
To authenticate yourself as a customer in a webshop you should use Customer.login.