If you are running this broadcaster side, then you’ll use a clientID to generate an Implict Auth token.
You’d get the broadcaster to login via Twitch,
Then use that oauth token.
Here’s a pure JS example
https://barrycarlyon.github.io/twitch_misc/authentication/implicit_auth/
Using just a ClientID the caster can login, giving you the oAuth token and the broadcaster ID to call the API with. ClientID’s are public and can be shared.
The alternative is a proxy server as you already suggest. Your mod talks to your server and the server uses an App Access Token to query the API with.
Personally, I’d go the proxy route as then you can cache data and save some lookups.