HI @jbo,
The user is specified by the access tokens you include as part of the authorized request. You get the user access tokens as a result of having that user sign-in with Twitter to grant your app access.
However, you only need a webhook subscription for your bot account, not users interacting with it. Any message sent to your bot’s @username will be sent via that webhook subscription.
I can see where there may be confusion in how your quoted statement is phrased. We’ll clear that up.