Hey @niall!
Thanks for the detailed description - I guess first and foremost it would be good to know what exactly you are looking to accomplish via the Management API. I say this because any Management API access token you get via a SPA is going to be fairly limited and may not suffice for your use case.
Ideally, the getting and using of Management API access tokens should be handled by a backend as outlined in the following FAQ:
If you’re interested, here is an example using our Node Management Client paired with our React sample app.