I was experiencing a similar issue and discovered I had created an environment variable with the same name as my collection variable. The environment variable took precedent and overwrote the collection variable I was updating.

To check this, there is a UI element in the top right next to the environment dropdown. It shows all the variables being used in your request. Next to each variable is a character in a coloured box which indicates the source of the variable.

Once I deleted the environment variable my requests authorised correctly.