401: Missing User OAUTH Token (get-custom-rewards)

Will the redemptions of default rewards be detected via PubSub? Or can them be detected somehow?

I feel like I can use OIDC implicit code flow the following way: since I need that token just to retrieve custom rewards and this can be done occasionally, I can create a small form (input text box + button) where the broadcaster will be able to insert the token and with the click the script will make the call to Twitch APIs. This way the broadcaster will be able to update their rewards when needed.
What do you think about this?