It’s not a language I work with, but from a brief look I don’t see where TwitchManager.getAccesToken() is returning just the token, as it looks like you’re trying to use the whole response from the OAuth process rather than the actual token itself.
No, that’s incorrect. Profile images are public, and you can see by the documentation for that endpoint, https://dev.twitch.tv/docs/api/reference/#get-users, that the only data returned that requires a User token with the appropriate scope would be the email field. If you don’t need the users email address then an App token will work for that endpoint.