tokenOptions is passed directly to the getTokenSilently method on the underlying SPA SDK. Please see the documentation for more detail on the properties that are accepted.
So the httpInterceptor will pass the scope and audience in tokenOptions to the getTokenSilently method, to obtain a valid token to make the request (to /api/orders). getTokenSilently can use these values to ensure that the cached access token or refresh token satisfy the requirements (appropriate API and optional scope), or get a new token if it’s necessary.