Should be possible. After the 1st REST call use the JavaScript Processing area to set a Session Var value to be whatever the response is, I’m assuming it’s JSON data? In which case it should be easy to extract the token from.
Then create another REST submission action and use %globals_session_<your session var from the 1st REST call>% as the dynamic value in the 2nd REST call.