The recover password endpoint has to generate the recovery token before calling the email endpoint. The email endpoint cannot generate tokens as that is not its job

[markessien]