When you’re logged in to Twitch it’ll likely be using permissions from your currently logged in account. If you logout of Twitch you should get the same response as incognito.
Secondly, secret_token isn’t the correct way to send OAuth tokens. You should be setting the Authorization header as specified in the docs https://dev.twitch.tv/docs/v5/reference/channels/#get-channel-subscribers
Finally, if your token has no scopes then it can’t access that endpoint anyway, the deprecated v5 endpoint requires channel_subscriptions , or if you want to use the up to date Helix endpoint https://dev.twitch.tv/docs/api/reference/#get-broadcaster-subscriptions you need the channel:read:subscriptions scope.