Hi @palinko91,
Have you checked this thread: Updating users roles via Netlify Serverless function (When logged in as another user)
TL;DR: You should not rely on the authorization header if you want to make changes as the user. You should restrict this ability to an admin-only and work using user IDs.