Sounds like you have 2 separate issues going on. The error is caused by attempting to show an api.twitch.tv URL in an <(i)frame>, which violates the content-security-policy you’ve set on the page you’re developing, whilst the real issue is api.twitch.tv ending up in an iframe in the first place.
Another thing is the js sdk is very old. It uses v3 of the public API, which isn’t publicly documented anymore and highly discouraged for new development. The authorization part (login, logout) work absolutely fine, so it’s alright to use it for that.
P.S. Code markdown with 3 backticks above and below the code (```)