Appreciate the moderator scopes on this 
Edit: .receive is correctly moderator scoped, but .create should not be. Example use case is: third-party chat applications like chatterino/chatty that would like normal users to be able to see outbound shoutouts. Now uservoiced @ Shoutout Create EventSub Subscription should not require moderator auth – Twitch UserVoice