You are missing a ? before client_id so the URL is invalid. But That appears to be present in the postman screenshot (but has a … before it so I had to ask for the URL you are using).
So not sure if you typoed the URL into postman hence the ....? in the screenshot.
I wonder if you have typoed and doubled up your query string bars and bad concatenated the form data
Is a javascript/nodeJS example of Step 3 of Authorization.
You can use the bots token to call webhooks. Webhooks for stream/follow/public data, accepts any valid oAuth, but subscriptions/moderation events will need the broadcasters oAuth.
So you can reduce the key count by using the bots key with webhooks. Personally my webhook handler uses an app access token, so the bots key is kept to the bot for logging in with.
Personally, I have some segregation in my services. So my bot only has the bots token, and doesn’t make any requests to Twitch itself other than to maintain it’s token.
I have a webhooks handler, that for the most part uses the broadcasters/subscriber user access token I have generated for all it’s tokens.