Thanks Barry.
To answer your questions:
- Yes, I’m using a publicly accessible HTTPS callback URL hosted with a web hosting provider (not localhost).
- SSL is valid, and the callback URL is externally reachable (verified independently).
- Twitch OAuth to the same hosted application works correctly, so communication with Twitch itself is working.
- I’ve also tested the callback endpoint using the Twitch CLI from my local PowerShell against the same hosted callback URL, and the validation/challenge handling works as expected.
The one thing I can’t explain is that the actual EventSub webhook verification never appears in the hosted site’s access logs or application logs. It’s as though the request never reaches the origin.
I also found this older discussion where another developer reported their host indicated the default EventSub Go-http-client/1.1 User-Agent was being blocked by upstream security before reaching the application:
I’m not assuming that’s the cause here, but the symptoms seem very similar. Have you seen anything like that recently, or is there anything else commonly overlooked that could prevent the verification request from ever reaching the origin?
If this is only affecting the callback, I might look into having it call my self-hosted core backend instead but it seems… Complicated.
