I got app token and user token mixed up, that was my mistake. I went back and reread (for what feels like the umpteenth time) and see where all the responses will be post responses back to me.
It does appear that I need to send the challenge back after the initial subscription.
Return the value of
challengefrom the callback verification request to complete the verification process. Your response must be a raw string. If your server is using a web framework, be careful that your web framework isn’t modifying the response in an incompatible way. For example, some web frameworks default to converting responses into JSON objects.
pogchamp-kappa-360noscope-vohiyo
I think I have things mostly figured out now, just need to flesh it out a little more.
I would love to see Hosting added to the events.