Firma HMAC-SHA256

const crypto = require("crypto");

function verifySignature(payload, signature, signingSecret) {
    const expectedSignature = crypto
        .createHmac("sha256", signingSecret)
        .update(JSON.stringify(payload))
        .digest("hex");

    const expected = `sha256=${expectedSignature}`;

    return (
        signature.length === expected.length &&
        crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
    );
}

const crypto = require("crypto");

const payload = { /* su payload aquí */ };
const signingSecret = "su_signing_secret";

const body = JSON.stringify(payload);
const signature = crypto
    .createHmac("sha256", signingSecret)
    .update(body)
    .digest("hex");