Missing scope: channel:read:subscriptions or channel_subscriptions

The secret is whatever you want it to be. Whatever string you define as the secret is what Twitch will use to sign each notification they send to you, that way you can use that secret so validate all notifications.