Assuming that you have read the automation policy carefully…
You will still need the user token to perform a retweet, as a user context is required as you’ve already found.
In terms of the headers, most libraries for communicating with the Twitter API will handle this for you. If you’re building a mobile app, you could use Twitter Kit for iOS or Android to call the API and this will deal with the headers and OAuth encoding.