This is the code i'm using

curl --location 'https://www.strava.com/api/v3/push_subscriptions' 
--header 'Authorization: Bearer xxxxxxxxxxxx'
--header 'Content-Type: application/json'
--data '{
"client_id": "124236",
"client_secret": "xxxxxxxxxxxxxxxxxxxx",
"callback_url": "https://webhook.site/f8c1dd6f-3315-404c-a1d4-5f69dadffc27",
"verify_token": "Strava",
"aspect_type": "create",
"object_type": "activity"
}'

I'm just going to merge everything into one reply rather than reply to each of your updates...

1. Follow the guide for setting up webhooks @ https://developers.strava.com/docs/webhooks/. The example cURL requests you've shared don't match what is shown on that page (e.g. you don't need to pass an auth token in the header, the 'object_type' and 'aspect_type' fields are not valid fields for a push subscription request, etc...)

2. The error message you are receiving is fairly generic and says the callback_url is not verifiable. It means that you aren't following all of the required steps to do the handshake with Strava to set up your callback. There are only 2 steps which need to be followed:

1. Make the cURL request to push_subscriptions with valid parameters, see the "Subscription creation request" section. Note that the request will not return immediately, it requires you to complete step 2 first (or it will time out/error if something goes wrong)
2. Respond to the GET request from Strava to your server. The contents of the GET request and how to respond to it are detailed in "Subscription validation request" and "Callback validation," respectively

If everything went well, you will get a subscription ID returned to the cURL request in step 1. Otherwise you'll get an error message. The error message "field" paramter will tell you which part went wrong, and "code" will tell you what was wrong with it, though it may be a bit vague.

I can't tell you exactly how to code your webhook endpoint because that will depend on the programming language you're using. It seems like webhook.site has its own scripting language for custom actions so you'd have to figure out how to use that to respond appropriately.