Using channel_check_subscription, the broadcaster should of when attempting to activate the extension been sent thru an oAuth loop and performed the oAuth loop. You then stored the access_token and refresh_token
When the access_token expires (which you can check using the expires_at passed when you oAuth loop), you can use the refresh_token
When a user/viewer allows you to access their UserID, you then need to pass that to your EBS which can perform the lookup as signed with your secret.
But you are calling the wrong end point. For the scope you have requested you need this https://dev.twitch.tv/docs/v5/reference/users#check-user-subscription-by-channel end point not the general subscriptions end point. https://api.twitch.tv/kraken/users/<user ID>/subscriptions/<channel ID>
And of course follows is on https://dev.twitch.tv/docs/v5/reference/users#check-user-follows-by-channel https://api.twitch.tv/kraken/users/<user ID>/follows/channels/<channel ID>
Hope this helps!