HI @Laszlo Katai-Pal​ 

You need to provide CAN_USE permission to the service principal in the token manage permission, you can see this option in : Admin->workspace setting

Once you provide this permission to your SP , you can create token on behalf of SP