Hey @tms I apologize for the delayed response on this one, and wanted to thank you for sharing your progress with the community 
Just to clarify a couple things - Outside of some limited scopes afforded to SPA/Public apps, the management API needs to be accessed by a server-side (private) application. Some more on the differences between private and public applications can be found here.
The management API can also be accessed via extensibility features like Actions, as outlined in this FAQ:
https://community.auth0.com/t/how-can-i-use-the-management-api-in-actions/64947
Another common use case is to proxy calls to the management APi:
Hope this helps at least provide some clarity!