Your twitchers contains user_logins, not user_ids.
The secret is only needed in the authorization flow (hitting id.twitch.tv), and only in code running on a server, never in a browser.
Using ajax, the client-id header is sent as
headers: { 'client-id': your_client_id }