They don’t need to be logged in to see the thumbnail itself, they need to be logged in to access the API. If you want to do it only in the browser, your only option for Helix is to use the user’s access token. If you want to setup a server, the server can request the thumbnail from the API, then send that to the browser for the viewer to see without logging in.