Set up Twitch EventSub webhooks to receive channel events

Steps

1. Register an application in the Twitch Developer Console to obtain a client_id and client_secret; authenticate using the Client Credentials flow (POST https://id.twitch.tv/oauth2/token with grant_type=client_credentials) to get an app access token.
2. Deploy a publicly accessible HTTPS endpoint (no self-signed certs) that can receive POST requests; Twitch requires the callback URL to respond to a challenge during subscription creation.
3. Create a subscription by POSTing to https://api.twitch.tv/helix/eventsub/subscriptions with Client-Id: {client_id} and Authorization: Bearer {app_access_token} headers, and a JSON body specifying type (e.g., stream.online), version, condition (e.g., broadcaster_user_id), and transport with method: webhook, callback URL, and a random secret string.
4. When Twitch sends a POST to your callback URL with a message_type of webhook_callback_verification, respond with HTTP 200 and the challenge string from the request body within a few seconds.
5. Validate all subsequent event notifications by computing HMAC-SHA256 of the Twitch-Eventsub-Message-Id + Twitch-Eventsub-Message-Timestamp + raw request body using your subscription secret, and comparing to the Twitch-Eventsub-Message-Signature header (prefixed with sha256=).
6. Acknowledge every valid event notification with a 200 response; Twitch will retry deliveries that do not receive a timely 2xx response.