I am new to Auth0 and authentication in general. I have come across Possible to get IdP access token without server? - Auth0 Community and am still confused about whether I am able to pass these access tokens back to my client-side app to be used to directly call the social provider APIs without going through a server.
The only thing I would be using a server for is to issue a client credentials grant using the read:user_idp_tokens scope. I don’t want to violate the terms of service for any social providers.
You should not expose the social provider access token issued as part of the end-user authentication flow to the client-side application. The access token was issued as part of a server-side flow managed by your Auth0 domain on your behalf so exposing it to the client-side would break the expectation of the issuer, in particular, the social provider issued the token assuming it was for a server-side application and as such the access token may have characteristics that are only meant for such applications.
In conclusion, it would be technically possible, but you should not perform it.