Yes possible but best practice is get token via api gateway in one place and one time as per request, after that this will pass to microservices.
You can follow security concerns on below article;
https://medium.com/aspnetrun/securing-microservices-with-identityserver4-with-oauth2-and-openid-connect-fronted-by-ocelot-api-49ea44a0cf9e