Graph Api subscription creates webhooks without token validation most of the time

Question

I've followed the steps mentioned in the docs here https://learn.microsoft.com/en-us/graph/change-notifications-delivery-webhooks?tabs=http.

However, the api is siply not behaving as it's stated there. Most of the time, the request allows me to create a subscription and sends data on events to the notificationUrl I've stated.

Sometimes though, it does send the initial request with the token that I need to decode and return (alongside 200OK within 10 seconds). This is unexpected behavior.

I've tried this with some free publicly available URLs and the same thing happens. I thought it might be some kind of security setting or whatever in Salesforce (since I'm using this api in SF) but it's not.

Alongside that, the lifecycleUlr never gets triggered and my subscriptions expire just like that.

Can someone help with this?