Api post to update endpoint doesn't take the user_id from the token, but posts in the name of the one who installed the app?

With

mutation {
    create_update (item_id: ${itemId}, body: "${body}") {
        id
    }
}`;

I post an update. But the displayed author of this update is not taken from the user_id, nor from the app itself, but apparently from the one who installed the app. Is this something an app can change?