Can any user create an API token, or only admins?

Any signed-in user can generate and manage their own API tokens from the API page in their profile. Because a token inherits that user's permissions, what a token can do through the API is exactly what that user can do in the app.