Yes. Validation tokens can be created for anyone who is authorised to act on behalf of a not-for-profit organisation when they need to access a product or service that requires a token.
Because validation tokens expire after 60 days, it is best to create them only when they are needed.