So for Conduits or webhooks (webhooks in your case here)
You need PRIOR Auth from the broadcaster
You need to do user auth with the scope (channel:read:ads) from the broadcaster_user_id in the condition.
Then ignore that token (or store it for other use if it has useful other scopes on it)
Generate app access token with no scopes. And away you go.
This type doesn’t support a moderator_user_id in the condition and/or using auth/permission from a moderator. It has to be the broadcaster
For future ref: App Access Tokens cannot have scopes.
They will inherit the permissions of prior authentication from the users that auth to the ClientID.
In Summary the steps are:
Get a User Token from the broadcaster with the scope channel:read:ads
After that authentication is complete, create an App Access Token (or use an existing one for the same ClientID you user token’ed with)
Create a subscription request
And unless noted with the presence of a moderator_id in the condition for any type/topic on a webhook that is scoped this model applies. (chat types are different but we’ll only discuss general types/topics here)