This is a security risk and SHOULD NOT be used.

First, what Greg V said. You can just monkey patch the js client to expose the private route. Never trust client code for authorization…

Second, do not store secrets (like access tokens) in the local storage, see https://auth0.com/docs/security/store-tokens#don-t-store-tokens-in-local-storage or https://dev.to/rdegges/please-stop-using-local-storage-1i04