Are you sure you’re using the client_credentials auth flow to create an App token? Using a User token will not work.
EventSub uses a POST request for verification, not GET. Also you do need to send back a challenge, as shown in steps 3. 4, and 5 of the EventSub guide EventSub | Twitch Developers