Hey @tms I apologize for the delayed response on this one, and wanted to thank you for sharing your progress with the community
Just to clarify a couple things - Outside of some limited scopes afforded to SPA/Public apps, the management API needs to be accessed by a server-side (private) application. Some more on the differences between private and public applications can be found here.
The management API can also be accessed via extensibility features like Actions, as outlined in this FAQ:
Another common use case is to proxy calls to the management APi:
