Awesome, glad that was it!
The way you are using it currently is fine, but the recommended approach is to proxy Management API requests through a backend of sorts: