At this time the use of Lock in conjunction with API authorization (aka audience parameter) within your own client application is not yet documented so you should not rely on that as it’s subject to changes before being documented.
The supported mechanism at this time to make use of API authorization is to use Auth0.js v8 and go through the hosted login page. As you may have noticed by the fact that Lock already has some undocumented parameters related to API authorization there is work in progress to enable also the scenario you mention, however, this is not yet completed and documented.