Client Credentials (ie, App tokens) should only ever be used server-side or otherwise you’re exposing the client secret in the page.
If you want to get a token client-side you should use the Implicit flow https://dev.twitch.tv/docs/authentication/getting-tokens-oauth#implicit-grant-flow