Don’t do this.
You need to reply to it like you would a website login to your website.
- Someone goes to a page
- Fills in the login form
- The users hits login
- You reply “password ok” or “password invalid”
This works simarily in eventsub
- You Tell Twitch to make a subscription
- Twitch fills in a form
- Twitch hits go
- You reply with the challenge (from the form) or reject it
In neither of these examples do you make a “second” request to an API.