Cannot get banned users - Forbidden 403

App Access Tokens (which you get from the client_credentials flow) are the wrong type of token. They’re not associated with any particular channel as they are generated by an app.

You need a User Access Token, and the user for which you wish to access the private information of has to be the one to go through your OAuth flow and explicitly grant your app the permission to access data with the moderation:read scope.

The Auth Code Flow docs will guide you through the process: https://dev.twitch.tv/docs/authentication/getting-tokens-oauth#oauth-authorization-code-flow