If you’re the extension owner then yes you have to use your ID. but auth.userId isn’t your ID.
If you check the docs for onAuthorized https://dev.twitch.tv/docs/extensions/reference/#helper-extensions you’ll see that the userId field is an Opaque User ID. What you need to use is your actual Twitch ID.
Technically speaking if you correctly create a token the request would still work if made from the front end, but there’s no point trying as like I said previously it would be a security breach and your extension can’t be approved as you would even by violating your Developer Agreement by exposing your secret.