Hi @TheScannerGuy,
Welcome to the Auth0 Community!
You’d typically have the SPA making requests to your backend API with an access token instead of just sending the sub/user’s name. The token lets your API know the request is legitimate.
The sub claim is how you can identify the user in your DB. The access token will include the sub claim, which your API can use to associate the Access Token/request/user with a user in your DB.
This resource covers the scenario in depth: Single-Page Applications (SPA) with API