If you encode it, how do you use it? As if it’s encoded then you have to be able to decode it to use it.
Then every time you want to look at the moderator list you’d have to load from the API. Which can introduce latest on duplicate loads.
Generally, depending on why you need this, you’d load once from the API then use EventSub to track moderator add/remove (and periodically full recache fro mthe API)
When using oAuth the ?code is a one use code that is used to exchange for an access token, so storing the code is useless.
However, yes you can store the generated access token (if using regular oAuth), of the returned #access_token in local storage if you want, and then use that until it expires, that is a form of ssession management that would work.
It’s also perfectly valid to store the users own token on their own machine.