Webhook subscriptions active, zero deliveries — verified against two independent endpoints

[kopmazch]

Describe the bug

All ten webhook subscriptions register successfully and are confirmed present via
GET /public/v1/events/subscriptions, but no event has ever been delivered —
not one HTTP request has arrived at the configured webhook URL, for any event type,
across several hours of testing.

There is no failure signal anywhere: no rejected request, no retry, no
unsubscribe. Requests simply never arrive.

Setup

• App: kopmazstreamerhelper (client id 01KZ293Z2Y3T6VVR8PA8ZF5PY8), created 2026-08-03
• Broadcaster: 28231177 (kick.com/kopmaz)
• Webhooks toggle: enabled in the developer tab
• Webhook URL: https://alerts.ksolutionlabs.com/kick/webhook
• Redirect URI: https://alerts.ksolutionlabs.com/auth/callback
• Granted scope: user:read channel:read channel:write chat:write events:subscribe channel:rewards:read
• A bot has been created for the app (per Webhook not working until i created a bot for my application #212)
• Endpoint is a Cloudflare Worker — no ngrok, no tunnel, no self-hosted origin

Subscriptions (verified live, method=webhook, all v1)

channel.followed (01KZ2APFG9K8KRXEBKG5ERSPVN), channel.subscription.new,
channel.subscription.renewal, channel.subscription.gifts, kicks.gifted,
channel.reward.redemption.updated, livestream.status.updated,
livestream.metadata.updated, moderation.banned, chat.message.sent

To Reproduce

1. Create app, enable webhooks, set webhook URL
2. Complete OAuth 2.1 + PKCE, obtain user token with events:subscribe
3. POST /public/v1/events/subscriptions for the events above — all succeed
4. GET /public/v1/events/subscriptions — all ten present, method=webhook, correct broadcaster_user_id
5. Trigger events: chat messages from a second human account, a follow from a
   second account, messages sent via POST /public/v1/chat
6. Observe zero inbound requests

Final verification pass (2026-08-02 ~23:57 UTC)

• All ten subscriptions were deleted and recreated after the bot existed and
  after the current OAuth grant — creation timestamps 23:57:58Z–23:58:01Z
• The webhook URL was visually re-verified as saved in the developer dashboard
• A chat message ("Second test") was sent by a second human account
  (Nerd_robot) in kick.com/kopmaz
• The endpoint now writes a permanent database receipt for every delivery that
  passes signature verification. Receipt count after all of the above: 0

Since then: two full live streams (2026-08-04 and 2026-08-05) with real
viewers following and chatting. Receipt count is still 0 — not one event
type delivered, live or offline, across the app's entire lifetime.

What was ruled out

• Endpoint reachability — POSTs from five different client identities (empty
  User-Agent, Go-http-client/2.0, python-requests/2.31, curl default, a
  Kick-style agent) all reach the Worker and receive its own 401 bad signature
  response, not an edge challenge page.
• WAF / bot protection — the same test was repeated against a workers.dev
  endpoint, which is not a customer zone and has no WAF or Bot Fight Mode. It
  accepted arbitrary POSTs and returned 200. Kick delivered nothing there either.
  This was specifically to test the Go-http-client blocking described in Not getting requests from webhook subscriptions #367.
• Missing bot (Webhook not working until i created a bot for my application #212) — a bot was created; POST /public/v1/chat succeeds and
  messages appear in chat. Subscriptions were then deleted and recreated with the
  bot in existence. Delivery still zero.
• Stale subscriptions — deleted all and recreated after the webhook URL was
  confirmed saved. New subscription IDs, still nothing.
• Wrong channel — GET /public/v1/channels confirms the token resolves to
  broadcaster 28231177, slug kopmaz, matching the subscriptions.
• Self-echo suppression — tested with messages from a separate human account,
  not only via the Chat API.

Expected behavior

An active method=webhook subscription should deliver events to the configured
URL, or surface an error explaining why it will not.

Additional context

Related open issues with the same symptom: #367, #390.

Per the "default webhook limit for unverified apps" mentioned in #398 — if
unverified apps have restricted or disabled webhook delivery, that would explain
everything above. In that case: please verify this app (client id
01KZ293Z2Y3T6VVR8PA8ZF5PY8), or document the restriction so new developers
stop debugging their own endpoints for days.

Happy to provide request logs, subscription IDs, or run any diagnostic that would
help — the endpoint is instrumented and every inbound request is logged.