Trying to make a start on using EventSub (PHP)

Ok… I looked at https://dev.twitch.tv/docs/api/reference#create-eventsub-subscription it doesn’t mention needing a user access token (specifically says app access). Having just checked the script our website uses to generate tokens when people login via Twitch, it is labeled as a user access token, I’ve no idea what the other lone string is for. So the subscription to get data about Twitch subscriptions requires both? Does the user token go in the header or…? I’m also not sure what the secret should be - can it be something I just make up?