Authrization Code Flow for SPA

One more question. If the access_token should not be passed to the JS Front, does it have to go through the Express server that has the access_token when making a request from the Front to the Twitch API?