Don't trust user input - created subscriptions for the signed in user only.
Call with the subscription, not self