title: Setting webhook results in 'Unauthorized WebHook callback channel' . Everything should be fine
body: <p>Time to go to SE, since this has cost me more then 4 hours now. </p>
  
  <p>I'm trying to setup a webhook (<code>https://app.example.com/notications</code>) for Push Notifications coming from Google Drive API. </p>
  
  <p>After having set-up everything I'm getting error: </p>
  
  <pre><code>    ...
      errors": [
          {
              "domain": "global",
              "reason": "push.webhookUrlUnauthorized",
              "message": "Unauthorized WebHook callback channel: https://app.example.com"
          }
      ],
      ...
  </code></pre>
  
  <p>There are a couple of results on google (most of which are here on SE) that talk about this issue. None of the solutions presented seem to work for me. Needless to say, I would be pretty much tearing my hair out if I had some. </p>
  
  <p>This I what I've tried: </p>
  
  <p>As explained <a href="https://developers.google.com/drive/web/push" rel="nofollow noreferrer">here</a> there are some requirements: </p>
  
  <ol>
  <li><p>Step 1: Verify that you own the domain. (Complete the site verification process using Webmaster Tools) </p>
  
  <p>Registered <code>app.example.com</code>, through Webmaster Tools. Separately also verified <code>example.com</code> although this should not matter. <strong>Check!</strong></p></li>
  <li><p>Step 2: Register your domain:</p>
  
  <ul>
  <li>Go to the Google Developers Console.</li>
  <li>Choose or create a project.</li>
  <li>In the sidebar on the left, click APIs &amp; auth, then click Push.</li>
  <li>Click Add domains.</li>
  <li>Fill in the form, then again click Add domains.</li>
  </ul>
  
  <p>Done for <code>app.example.com</code>. <strong>Check!</strong></p></li>
  <li><p>Note that the Drive API will be able to send notifications to this HTTPS address only if there is a valid SSL certificate installed on your web server. Invalid certificates include:</p>
  
  <ul>
  <li>Self-signed certificates.</li>
  <li>Certificates signed by an untrusted source.</li>
  <li>Certificates that have been revoked.</li>
  <li>Certificates that have a subject that doesn't match the target hostname.</li>
  </ul>
  
  <p>What I've done:</p>
  
  <ul>
  <li>I've setup <code>app.example.com</code> with an SSL certificate. </li>
  <li>Moreover the endpoint is reachable and everything checks out. </li>
  <li><a href="http://www.sslshopper.com/ssl-checker.html" rel="nofollow noreferrer">SSL checker</a> has verified that everything is okay (5 ticks). Even the SSL-chain is setup correctly.  <strong>Check!</strong></li>
  </ul></li>
  <li><p>constructing a POST query</p>
  
  <ul>
  <li>to the simple <code>https://www.googleapis.com/drive/v2/changes/watch</code> endpoint</li>
  <li>containing a <code>Authorization: Bearer x</code> header</li>
  <li>containing a <code>Content-Type:application/json</code> header</li>
  </ul></li>
  </ol>
  
  <p>Post contains a body as follows</p>
  
  <pre><code>    {
        "id": "someIdThatDoesntMatter",
        "type":"web_hook",
        "address": "https://app.example.com/notifications"
      }
  </code></pre>
  
  <p><strong>Check!</strong></p>
  
  <p>I'm running all this through Postman (a Chrome extensions to test http requests) so there's no app at my side that can be interfering. </p>
  
  <p>What on earth could be the problem?</p>